Up to date Wordpress site hacked

[Zoon]

Our business page which is really just contact information and a few pages has apparently been hacked and the hosting company have took it offline for hosting malicious content.

The only problem is I cannot access the wordpress admin page to see what the issue is so I'm not really sure what to do next.

Does anyone have any pointers please?

Thanks in advance.

[Scabutz]

A word press site hacked! I am shocked, shocked I tell ya.

Anyway sounds like you are at the mercy of your hosting provider. You and going to have to speak to them. See if they will re enable the site but IP restrict it to yourself so only you can see it and can sort it out. Otherwise do you have any back ups or do they provide any? If so you could ask them to restore to a point before the hack.

If they wont help though I think you are buggered and will have to start again.

[feef]

you need to get onto the host via SSH or FTP to see what files have been affected, and probably also into the database.

The easiest option is most likely to blow it all away and restore from a last-known-good backup.

Cleansing an infected wordpress database isn't trivial

[Zoon]

Managed to get in via ftp but cannot see any files that have been modified recently, comments aren't enabled either.
A bit of a strange one.

[anonymous-user]

thanks for the prompt to check my backups!

Just to do a clean restore to last known healthy state? Don't mess about.

[TonyRPH]

Zoon said:

Managed to get in via ftp but cannot see any files that have been modified recently, comments aren't enabled either.
A bit of a strange one.

There won't necessarily be any changed files.

The attackers would have found a way to inject data into the database, that's the most common approach.

You either need to get a copy of your database and examine it, or if you have a backup of the DB restore that instead.

It is possible to edit the database directly with apps like phpMyAdmin, however you really need to know what you're doing.

[feef]

TonyRPH said:

Zoon said:

Managed to get in via ftp but cannot see any files that have been modified recently, comments aren't enabled either.
A bit of a strange one.

There won't necessarily be any changed files.

The attackers would have found a way to inject data into the database, that's the most common approach.

You either need to get a copy of your database and examine it, or if you have a backup of the DB restore that instead.

It is possible to edit the database directly with apps like phpMyAdmin, however you really need to know what you're doing.

This is why my day-rate as a DBA is not to be sniffed at

[Zoon]

All sorted, there were two files uploaded and one file which had a line of script added to it.
Back up and running now.

Thanks for the advice.

[TonyRPH]

Have you checked every file?

The last time I had a Wordpress hack, there were many changed files.

Also, consider installing the WordFence plugin.

[Zoon]

TonyRPH said:

Have you checked every file?

The last time I had a Wordpress hack, there were many changed files.

Also, consider installing the WordFence plugin.

Thanks, WordFence installed.

[king arthur]

Don't just install Wordfence, go through the options and nail everything down to the minimum you are comfortable with, e.g. minimum number of login attempts before IP ban, etc. It doesn't by default block crawlers that breach a maximum number of requests per minute, you should enable this. Consider upgrading so it can get a global list of hacker IPs and ban them before they even hit your site.

[SCEtoAUX]

Change your admin URL too. (If you haven't already done so).

[otolith]

feef said:

This is why my day-rate as a DBA is not to be sniffed at

This is why my response to the suggestion that we should use Wordpress to host our marketing content was that used in Arkell v. Pressdram.

A while later I was quite gratified to see our main competitor’s site completely infested with links to dodgy pharmaceuticals and gambling sites via a Wordpress hack.

[feef]

otolith said:

feef said:

This is why my day-rate as a DBA is not to be sniffed at

This is why my response to the suggestion that we should use Wordpress to host our marketing content was that used in Arkell v. Pressdram.

A while later I was quite gratified to see our main competitor’s site completely infested with links to dodgy pharmaceuticals and gambling sites via a Wordpress hack.

To be fair, I use Wordpress on a few sites and haven't had an issue on any of them.

I do keep them updated religiously tho, and have both Wordfence and Sucuri in use.

The sites I'm usually asked to investigate tend to be missing a few updates

[otolith]

Yeah, my feeling was that a saving in content management overhead (at the risk of the head of sales whinging at me if my guys drop the ball) was not worth trading for an overhead in managing Wordpress patching (at the risk of me having to explain why we'd been hacked if my guys dropped the ball)!