I Keep Getting Hacked

[TravG]

My one website which has a WordPress blog on it keeps getting hacked. Someone keeps getting into the WordPress section and changing my password and email. Every time I want to access the WordPress section of the site I have to then go in through phpMyAdmin and change the password back so I can log in.

WordPress is up to date, I have made the password pretty hard (I even had to write it down so I could remember) and I changed the email address back to me.

Is there anything else I can do to stop this idiot from getting into my site? The only good news is they never mess with it, just change the password so I cant log in so I guess that is good but it is still a pain in the a%* plus maybe one of these times they may do something to the site.

Any suggestions on how to stop this appreciated!

Thanks - Travis

[DaftDog]

You should get somebody to check all your code and the data in your database. You've obviously been infected so the intruder has a secret backdoor into your site. Could be a vulnerability in your theme or one of your plugins. If the hacker has placed code inside your database the infection will keep reoccurring until the code is removed.

I assume that you are using the latest version of WordPress.

Have you tried scanning your site with the Wordfence plugin? It does not check the data in your database.

[chaumi]

Go to your page and do a 'view source' to check they are not inserting viagra/casino etc links. I don't use Wordpress but when mine got hacked the only way I could see the inserted links was to view source...they were on the last couple of lines of code.

[WATP]

Hi Travis.

It could be so many things. First off, do you have any custom downloaded (or 'not paid for' but should have been 'paid for') themes or plugins installed? Often I've also seen rogue javascript code sitting in the main page/post files in the footer by just viewing the source in Firefox/IE but injections can also happen in the core .php files across Wordpress that are loaded by default. In my experience, this is usually an FTP hack which if you use FTP, could be another source of the issue.

The fact the password hacking continues means I think, one of 2 things. Something is giving him a backdoor into your server (as Ixias suggested) through your server itself or a WP vulnerability; or, you have a virus on your PC that is letting him see what you are up to on your end via keylogging or an FTP exploit. I had a version of this before, I called it 'the filezilla virus' and it's prevalent on hundreds of sites thesedays, especially through 3rd party banner hosting. If I visited a few dodgy sites to watch a film rip, usually a few days later I'd see all my sites get injected with rogue javascript. Now anyone visiting my site would get the same thing, it would look to see if they had filezilla and continue the problem exponentially! My situation was due to how vulnerable Filezilla is, they just store your raw passwords (or at least, they used to) in an xml file, with no encryption. I installed avast after the 4th or 5th hack and it's never happened since.

Since it's Wordpress getting hacked, it's probably not the same virus I was destroyed with, but try these steps first anyway since a backdoor to your PC will mean for sure the problem won't go away:

1) Use CCleaner to wipe any rogue temp files, I do this daily anyway, just to get rid of rubbish.
2) Download Avast (in my opinion, the best and least memory hogging). Run a full scan
3) Download Microsoft Security Essentials (These two can go side by side usually, but even just use it for a 1 time scan)
4) Turn on Windows Firewall if you haven't already
5) Download and do a 1 time scan with ADWCleaner, MalwareBytes, Kaspersky's TDDSKiller and RogueKiller. All do slightly different things and it's good to have them all just to run now and then (not to run permanently). I keep them on the desktop and run them every few days
6) If using Firefox/Windows 7 (or similar), update everything! I often run the "add on updater" in Firefox to check flash, javascript etc is all up to date and I have the Java Deployment tool blocked because it's vulnerable.

If anything is found by a scanner etc, you can double check after by re-running them all again in safe mode.

Otherwise, I think you might have to get some software or a scanning website to scan your domain or more specifically, to scan Wordpress for backdoor vulnerabilities that are being exploited or to find the rogue files in question. That is something I've never really done so I'm not sure how to proceed, but some hosting sites have virus scanning tools built in. Maybe could get a freelancer to check your domain over for you?

Hope that helps.

[casinovegas]

There is a good plugin available to change the standard .com/wp-admin url to anyone you want, maybe try that as well.

[sweetbet]

I'm not a wordpress expert, but what would happen if you log into your site via FTP and rename the /wp-admin/ folder to something like /asdjkieuasd/, then when you want to post something, you'd FTP into the site again and change the folder back to /wp-admin/ so you can log into the system? Would that stop the hacker? Just a thought.

[DanHorvat]

If you're using Firefox, enable the master password option. That way, your passwords will travel through the internet encrypted, whereas with the normal password manager they're out in the open. If your password is getting stolen because someone is sniffing your connection this will solve the problem.

I suppose you got a shared hosting account. If that's the case, ask your hosting provider to help you out and perform back-end security checks. Security is their responsibility.

There's one other option - another account on the same server could be hacked, giving hacker the root access to all other accounts, including yours.

[universal4]

I was gonna suggest what Dan did.

It could be someone else on the server is able to get to your folders, thus they are able to read the configs and get the password.

If you are hacked at home, you need to determine that so you can take appropriate action. If you suspect that and need to call me later, you are welcome to, I might be able to make a few suggestions.

A few of the suggestions above are good ones (I think Avast is the best free antivirus) but I would suggest running malware bytes as well. It is best to update the definition files then reboot into safe mode (command prompt) to run it, although you have to use dos commands to drill down to the folder and run it. This is the absolute BEST way to run a malware scan since it is sometimes the only way to catch stuff that loads and hides with explorer_exe. A full scan from safe mode can take 2 - 4 hours depending on how many files on the drive. Dump all your temp before that to save an hour.

If needed, I could write a bat file to run the malwarebytes for you in advance. (I would just need to know the location of the exe)

Also, nose around the database a little and make sure there are no other users.

Another option might be to try a plugin that moves the wp login, however if they have access to the root server that will only be a short term fix.

Rick
Universal4

[benl12]

Just pay sucuri .net $89. I heard good things about them.

Sent from my GT-I9505 using Tapatalk

[edgarf76]

I started to use securi, so far so good. Stay away from site lock. They tried to charge me 300 to remove malware. Securi did it for free with their subscription.


Sent from my iPad using Tapatalk

[universal4]

Problem is, if you are on a shared server, and it is hacked, or a hacker gains access to the root, paying a security company to secure your server won't help unless you are paying them to secure the ENTIRE server.

I would discuss this with the host BEFORE you spend any money on security.

Rick
Universal4

[edgarf76]

Aren't I sharing the server with myself? I have one I p, but I have several websites. Isn't that what shared hosting is?


Sent from my iPad using Tapatalk

[DanHorvat]

Shared hosting is when dozens or hundreds of accounts are hosted on one physical machine. If the physical machine is all yours then it's called dedicated hosting - and you can have multiple accounts, and you can also resell shared hosting plans if you want to. Dedicated hosting costs at least $200 p/m.

We can't know what you're using, you should know it. I believe Rick replied the thread starter, who is obviously on shared hosting.

[TravG]

Thanks to everyone, I will be trying some of these things. I am curious tho when say look at the source code what exactly am I looking for or will it stand out pretty well?

[mooonkey]

hi UltimatePokerBonus,

I have very good experience with hardening WP and cleaning affected Wordpress or CMS so I'd gladly help you (I work as developer at hosting company and hacked Wordpresses are not some unusual things, unfortunately, mostly hacked sites are because of not strong passwords and people doesn't care so much about their sites, mostly because they don't know)!
It happens me only once that my site was hacked, but I wasn't cared about that site so much..
First of all, if you have already been hacked, you should check and clean all of your files and database for malicious codes or infected files. If you are familiar with Wordpress structure, common folders and files, you will notice some of infected files / folders very quickly right after login through your FTP program! But the rest of your files should be done with some software because the rest of the huge number of files can not be done manually. One of the good program to scan and compare files with original Wordpress core files is Wordfence (when you install it, make sure it scans all what it can). It will list all problems and make sure you fix them all.

Next step is download your mysql dump and search for all common functions hackers usually use, like:
eval(
base64_decode(
preg_replace( (can be also used)
gzinflate(
gzuncompress(

Clean it.. Hackers very rarely infect codes to mysql, but never say never

Many themes come with timthumb functionalities, this is for croping and resizing images on the fly. Old versions of timthumb has very big security hole. Install and run timthumb vulnerability plugin and if alert appears, fix it.. If you skip this step and your theme does have vulnerable version of timthumb, your site can be always hacked no matter what you do with your web.

Install Bulletproof plugin, its robust applicaton which comes with sets of rules (very similar to mod_security rules). It will prevent your site from various intrusions..

Change your password, salt keys in wp-config.php, permissions on your files and folders (if you re hosted on Linux of course). BulletProof will show you recommended permissions to your files and folders..

Make sure your Wordpress and all of its plugins are up to date! If you used some nulled theme, check it because you can not trust to nulled shared themes..

Also, follow advices from other forum members, they are good!

If you need any help, you may contact me and we can make a deal!

[Sergej_AGR]

Block common exploits via htaccess, check WP Plugins, change WP admin url, add htaccess password to your admin section, change all passwords (including ftp access) clean your sourcecode and mysql manually, set the rights of files like configuration.php, .htaccess to 444 use the mentioned master pw addon or lastpass, check WMT for security notices and http://www.unmaskparasites.com/security-report/ etc

[universal4]

Travis,

Check time and date stamps on the files. This will often give you an indication of files that have changed recently.

Rick
Universal4

[robertmedl]

Just pay sucuri .net $89. I heard good things about them.

Sent from my GT-I9505 using Tapatalk

Ditto. I was having problems 6 months ago with my WP blog and paid sucuri to take care of it. No issues at all since then. Worth the $.

[Tapsino]

Ditto. I was having problems 6 months ago with my WP blog and paid sucuri to take care of it. No issues at all since then. Worth the $.

Yes, they are a great. I used them too once, it was a plugin issue and they solved it.