My Wordpress site is beign hacked by some hackers of Saudi Arabia. How can i prevent them from hacking. I have also found that many other Wordpress sites have also been hacked.

  • 2
    Unfortunately security hardening is overly broad topic and doesn't make good question (security depends on hosting, server stack, specifics of WordPress installation, specifics of WP users and their workflow, etc, etc). As for your specific issue - it is out of scope per FAQ. What you need is security professional looking at your compromised installation, not random advice from the street. – Rarst Apr 16 '12 at 14:56

Look at this answer I wrote for a more extensive explanation:

Malware on site

For a summary:

  • Add a login limiting plugin
  • Move wp-config.php out of the public html folder ( WordPress will look one folder up from its root directory if it isn't there
  • Use the correct file and folder permissions
  • Do not use the admin username
  • Make sure the first user in the database with ID 1, is not the admin
  • Hide what version of WordPress you're using ( by removing the generator tags in the header, use google for the code snippet, its a copy paste operation )
  • Use nonce's and check capabilities when building custom code
  • Use the wordpress filesystem APIs instead of writing your own upload code
  • Develop locally using LAMP/WAMP/XAMPP and do regular backups. If your site is compromised its just a matter of re-uploading what you have on your compute
  • Never, use eval, it's a huge security risk
  • Always use the latest version of WordPress
  • Always use the WP AJAX apis instead of using a custom PHP file and including blog headers php file
  • Avoid shared server environments ( there's a very real risk that someone else on the server isn't doing any of the above and gets hacked, and it cross infects your own secure install )
  • Don't use the wp_ db table prefix
  • Add a htaccess file to the wp-admin folder to password secure it to your IP
  • escape and validate all inputs no matter how trivial
| improve this answer | |

There is a good article about hardening your WordPress website. I have found this article very useful and followed the instructions accordingly.

Hardening WordPress

Alternatively you can use the following plugins for your own satisfaction:

Limit Login Attempts

Many thanks.

| improve this answer | |

Contact me Your Web Host webmaster...

and also update me WordPress Latest Versions and plugins, and also you can use this plugins..

WP Security Scan

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.