My WP Site Has Been Hacked. AGAIN.

[Glassman]

I have a blog hosted by WP.

It's been hacked. Again. This is the fifth time. Added to these events are someone sneaking in and changing text and adding links.

I have access to admin, but not the actual hosting side of things (was done by someone a few years ago). He's a friend of a friend and no longer does IT and this kind of thing. But he does get it back on after an email.

Why, or how is it getting hacked so much? What can I do to prevent?

[moonigan]

- Update WP to latest version
- Set a strong password for your admin account and make sure this is the only account with admin rights
- Restrict access to wp-login.php to your IP Address. This can be problematic if your IP changes often and the guy hosting it cba.
- Do something similar for the uploads

[Mr Happy]

Have you installed Wordfence?

Even the free version does a good job at stopping a good chunk of hacks etc.

Also, if you are taking comments etc. on your site, ensure you've got something like Akismet installed to help combat spam etc.

Both available from the WP plugins store.

[Evolved]

If you’re want, drop me a message and I’m sure we could help. Who is it hosted with?

[seveb]

As above, Wordfence and then use Cloudflare. https://www.cloudflare.com/it-it/integrations/word...

Even the free version of Cloudflare will improve performance and for US$20/month you get their specific WordPress plugin, WAF protection and a variety of other performance and protection benefits.

When changing the password make it something like dh7236$%gtqwpo9876 not words that can be guessed, and use a password manager like LastPass or 1Pass - both have free versions, so you don't need to remember it or type it ever.

[ReverendCounter]

When you log in to yourdomain.co.uk/wp-admin, and you look at 'plug ins', can you see anything that needs to be updated?

As mentioned, log in, change passwords, change email admin email address to start with, look at plug ins and WP version which could be very much out of date.

[aparna]

And change your hosting!

[deckster]

I can only echo everything has been said. WP is probably the most hacked platform on the planet and you really do need to actively manage it - just leaving it without updating absolutely everything you can on a weekly basis is begging for trouble.

[Brother D]

For evey site I manage I do the following:

1. Remove admin user and create random username
2. Install limit login plugin - https://www.limitloginattempts.com/
3. Use google/chrome generated password for the account with admin priv.
4. SSL via cloudflare (free) - also cloudflare offers numerous benefits on the free-tier.
5. Edit the wp-config.php file with the following: define(‘DISALLOW_FILE_EDIT’, true); (once you have finished your site changes).
6. Install “All-in-One WP Migration” once website is up and running to ensure you have a full easy to reinstall backup (and take backups evey so often).
7. Make sure you have at least a monthly reminder to update both WP and plugins

[hyphen]

Along with stuff said.

Have the minimum amount of plugins and 3rd party anything. And make sure they are popular ones in active development, and keep always updated regularly to their latest versions.
2 factor logins on all accounts. And 2 factor on your email account too.

If hosted by WP, assume they keep you updated with security patches? If not turn it on auto updates.

Edited by hyphen on Tuesday 5th October 23:00

[buggalugs]

If it’s been hacked once there will be little droppers and trojans all over it. They’re hard to get rid of and are often inserted into legit files. If the hack keeps coming back that will be the issue.

Also, google site:yourdomain.com and check for random spam pages listed on it.

[Glassman]

buggalugs said:

Also, google site:yourdomain.com and check for random spam pages listed on it.

Five pages of Japanese sites.

[dmsims]

Shield is a good alternative to Wordfence

Duplicator is a good plugin to move sites, use it to get your site to somewhere like Krystal Hosting and move the site

[dmsims]

Glassman said:

buggalugs said:

Also, google site:yourdomain.com and check for random spam pages listed on it.

Five pages of Japanese sites.

When you have secured / moved your site:

https://github.com/noitcudni/google-search-console...

[buggalugs]

It's a good couple of hours skilled work to clean up a badly hacked WP, I'd consider recreating the site if it's not too big. How long would it take to set that site up again from zero given that you've already got all the content, images, theme etc there? Get fresh copies of themes and plugins don't copy them from the old site. images etc are OK.

[hyphen]

buggalugs said:

It's a good couple of hours skilled work to clean up a badly hacked WP, I'd consider recreating the site if it's not too big. How long would it take to set that site up again from zero given that you've already got all the content, images, theme etc there? Get fresh copies of themes and plugins don't copy them from the old site. images etc are OK.

He can just restore from the last known good backup. If one exists.

[deckster]

hyphen said:

buggalugs said:

It's a good couple of hours skilled work to clean up a badly hacked WP, I'd consider recreating the site if it's not too big. How long would it take to set that site up again from zero given that you've already got all the content, images, theme etc there? Get fresh copies of themes and plugins don't copy them from the old site. images etc are OK.

He can just restore from the last known good backup. If one exists.

I'd suggest that might be difficult to ascertain...

[buggalugs]

hyphen said:

buggalugs said:

It's a good couple of hours skilled work to clean up a badly hacked WP, I'd consider recreating the site if it's not too big. How long would it take to set that site up again from zero given that you've already got all the content, images, theme etc there? Get fresh copies of themes and plugins don't copy them from the old site. images etc are OK.

He can just restore from the last known good backup. If one exists.

Not automatically - the hack often starts a fair while before you notice it so there's a good chance the backup will already have trojans / backdoors in it. Unless you've got backups from 3m+ ago but even then, you've then got to secure the site so they don't get straight back in the same way they did before.

That could be why it keeps getting 're-hacked', the current bod just bangs a backup back from a short while ago but that backup already has trojans in it.