[HELP] Wordpress site got hacked.

[gfxguru]

One of my wordpress site got hacked last month, but i had backup so i restored it that time.

today just 30 mins ago. i got email from my wordpress site.

subject: [xxxxxxxxxx] Password Lost/Changed
email content: Password Lost and Changed for user: boumkhalled



i immediately visited my site and found this running.



i than suspended the domain from my control panel.

now few question to hacking experts, how do i secure my wp site?

really looking forward to advance level tips.

gfxguru Reviewed by gfxguru on 24th Feb 2012. [HELP] Wordpress site got hacked. One of my wordpress site got hacked last month, but i had backup so i restored it that time. today just 30 mins ago. i got email from my wordpress site. subject: Password Lost/Changed email content: Password Lost and Changed for user: boumkhalled i immediately visited my site and found this running. Rating: 5

[sceneguy]

1.you should use the htaccess to password protect the wp-admin directory(dont use a plugin)
2.simple tip for any password: use a generator
3.change the url of wp-admin using a plugin or manually if you are comfortable
4.change the admin name to something else
5.modify your theme to remove ALL information about the version of wordpress
6.change the posttable prefix to something other wp_
7.use login lockdown plugin

tips that i remember,if you need anything specific,feel free


also,if you wanna retrive,
go to phpmyadmin from your cpanel,delete the user from wp_options,and add a new user.in the password field,use md5 hash from the net to encrypt your password.i can help in this as well,though i dont recommend you trust anyone for this purpose.

[gfxguru]

Thanks a lot for the tips

but how do i password protect the wp-admin directory with htaccess --any tutorial?
change the url of wp-admin using a plugin -- can you link me the plugin please.

[mirrorstack]

what version of wordpress where you using ?
is it 3.2.1 ?

[sceneguy]

do you have ftp access,paste the content of your .htaccess file (ofc,remove vital site info and change site url to domain.com)

download the version of your wordpress site and see if new files are present in your site root via ftp,file manager etc and report.

[gfxguru]

what version of wordpress where you using ?
is it 3.2.1 ?

i dont remember. what version was that.

do you have ftp access,paste the content of your .htaccess file (ofc,remove vital site info and change site url to domain.com)

download the version of your wordpress site and see if new files are present in your site root via ftp,file manager etc and report.

ok i checked on site files there is no .htaccess file in root.

i guess i have to install again properly..

[michaellin85]

^when you click on file manager, you will need to select "Show Hidden Files (dotfiles)" to be able to see.

[KingGoon]

One of my wordpress site got hacked last month, but i had backup so i restored it that time.

today just 30 mins ago. i got email from my wordpress site.

subject: [xxxxxxxxxx] Password Lost/Changed
email content: Password Lost and Changed for user: boumkhalled



i immediately visited my site and found this running.



i than suspended the domain from my control panel.

now few question to hacking experts, how do i secure my wp site?

really looking forward to advance level tips.

Most of the time wordpress gets hacked because a old plugin is not secure. What plugins do you have installed ? If you have some installed check out some exploit site like exploit-db and see if there is a exploit for the plugins your using

[vikassaini01]

Hi,
It may be because of old thumb or timthumb.php.
Read this :
http://www.awebmasterforum.com/wordp...-russian-site/

Hope it helps.

Check all plugins and until the issue is resolved, disable all your plugins.
Check your themes and upload folders for malicious files.

Ask your host to install a good firewall, Suhosin for PHP and Mod_security for Apache.
ask them to use latest ASL/gotroot rules for mod_security.

Also, ask them to install a good antivirus, root kit scanner and Intrusion Prevention/Detection System (IDS/IPS).