0

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, no admin user name, all latest versions, no timthumb issue, .htaccess security etc.

I dont want this to happen again, what I did notice is when logged into my WP admin I can edit the permalinks, or any file within the editor (I tested editing the index.php) and it will save.

On my last two servers, I had to go into the FTP set the permissions of the files to 755 or 777 before making any changes, then put them back to 644.

They are currently set to 644 but I can fully edit them within the admin, do you think this is my problem? Kinda worries me.

Thanks, Matt

Improve this question
2
  • I cant vote up until I have 15 rep. I did "thank" and set the answers to useful. Thanks im new to this site!
    – matt
    Commented Jan 5, 2012 at 18:29
  • You can mark answers as solution. The check mark is right beneath the voting arrows.
    – kaiser
    Commented Jan 5, 2012 at 18:32

2 Answers 2

Reset to default
2

You can...

  1. Learn about file permission (on wordpress)
  2. Install Wordpress Firewall plugin (version 2 for 3+ versions) (this dissalow access to any folder or file indirectly)
  3. Hide Your Wordpress Version
  4. Try to update plugins & Wp
  5. install Login Lockdown Plugin (this stops any brute force attemts)
  6. Verify that your theme doesnt show "publish by $username" but shows "display name"
  7. Use secret Keys in wp-config.. Keys Generator: here
  8. Move wp-config up one directory (wordpress would look for it dont worry..)

Hope this helps... if nothing else - at least install the plugins.

A small tale.. i used to host one of my website in some 1$ per month server (cant recall its name).. anyhow, it got hacked 4 times in 6 month's.. and i know a thing or two about wp security... nothing helped!

But - Once i left that hosting, the hacking stopped... :)

Have a gr8 day.

Improve this answer
5
  • Thanks, I have used a few things to help with security and I am now on VPS hosting. About moving the wp-config up a directory, what if its in my root/www folder? All my wp installs are in the root as they are wp websites not just blogs so I dont think that will work. The thing I really want to know is weither its normal to have the ability to edit files from the wp admin even if the permissions are set to 644.
    – matt
    Commented Jan 5, 2012 at 2:25
  • Edit wp-admin files from where... ? do you mean that the system / wordpress can edit those ?
    – Sagive
    Commented Jan 5, 2012 at 14:33
  • Yee... Moving wp-config is a problem for multiple installations
    – Sagive
    Commented Jan 5, 2012 at 14:33
  • Sagive SEO. To answer your question when logged in under Appearance > Editor any of the theme files can be fully edited and saved, even with permissions of the files set to 644. I know there are lots of security measures I can take but I just want to clear this up first and formost. It seems strange that I can do this.
    – matt
    Commented Jan 5, 2012 at 18:27
  • 1
    its ok you can edit that via your admin interface... On some servers thats not the case but those are inside server settings. On the othere hand use those plugins i reccomended to stop any brute force attackes & SQL injection attempts..
    – Sagive
    Commented Jan 5, 2012 at 20:55
0

I would strongly suggest checking the site out with someone like Sucuri Security since often times these hacks leave various backdoors to let themselves back in, or remnants in the database itself. It's very possible that a previous hack wasn't completely cleaned.

Improve this answer
6
  • Thanks I do use BPS security on all my sites...I gave it a scan with that one and nothing came up. Seems clean.
    – matt
    Commented Jan 4, 2012 at 18:08
  • It might be worth signing up and having them do a deep scan to look for suspect files that could pose a problem later on.
    – Norcross
    Commented Jan 4, 2012 at 18:33
  • Ill look into that, im cerious as to why the files are editable though through the wordpress admin as I described above, is this normal, I have not come across it on the other 3 servers I have used in the past. Thanks.
    – matt
    Commented Jan 4, 2012 at 20:07
  • well, things like the permalinks aren't editing WP files, rather, they write to the .htaccess file. Most of the other pages are saving settings to the database, not actually editing any files directly.
    – Norcross
    Commented Jan 4, 2012 at 21:51
  • Can You share the server Name? (or give a hint)... thanks @Norcross ... didnt know that website
    – Sagive
    Commented Jan 4, 2012 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.