MyPE

Community Business Directory, Event Listings, News and Views from Gqeberha, Nelson Mandela Bay

Dealing with a hacked web site

By

Web site owners are just like motorbike owners. Motorbike riders come in two flavours; those who have had an accident and those who are going to have an accident.

Web site owners also fall into two categories; those who have been hacked and those who are going to be hacked.

Every day, cybercriminals compromise thousands of websites. Hacks are often invisible to users, yet remain harmful to anyone viewing the page – including the site owner. For example, unbeknownst to the site owner, the hacker may have infected their site with harmful code which in turn can record keystrokes on visitors’ computers, stealing login credentials for online banking or financial transactions.

MyPE has been ‘noticeably’ hacked three times since 2005. The first time you are hacked is not a nice feeling of violation, eventually though the hacking and attempts become a normal part of business that you just adjust to. Even Google has recognised that people will try and hack and to that end they have set up a separate knowledge base to assist you with your hacked site, complete with step-by-step instructions and videos that outline each part of the process.

For some time, Google has been informing site owners when their sites have been hacked, but this new help center takes the next step and walks through how to fix the site and get the warnings removed from Google’s search results.

See the Google Overview video with help for hacked web sites:

Millions of web sites (like MyPE) run on the popular WordPress platform. MyPE has installed a few more hoops for potential hackers to jump through before they can get in and spread mayhem – by no means infallible but good enough to slow them down and maybe go ‘next door’!

Click here to contact Alan for advice if you have been hacked.

After a recent spate of repairing hacks on WordPress web sites I wrote this article for the MyServ web site:

Your WordPress site has been hacked and you are upset. Before going off on a rampage and blaming everyone consider this:

  • Hackers come in through poor security on themes and plugins as well as,
  • Brute force attempts on the wp-admin login

The WordPress Security Checklist below will help prevent those miscreants from hacking into your site and causing havoc. See also a list (further down) of on and offline resources that will help you trace what went on during the hack and tools to help prevent a further hacking attempt.

As a first step you need to immediately change your passwords (as in right NOW) and username (especially if it was admin and the password failed to include a combination of upper and lower case, special characters and numbers and was less than 15 characters in length). Now sit back and read.

Server Level Security:

Disallow bots from scanning the important WordPress directories: By using the Robots.txt file it is always a good idea to block the wp-content, wp-admin, etc. directories.

This can be done by adding the following line:
Disallow: /wp-*

Turn off directory browsing: Many servers by default allow you to browse the listing of files within a given directory. You may have come across this before when a page is missing or there is no index to a directory. The server outputs a listing of the files in the directory instead. This is particularly important in regards to plug-ins. If someone can see which plugins you have on your site they might be able to see which ones are vulnerable.

This can be done through your .htaccess by using the code below:
Options All -Indexes

Protect your wp-admin folder. The wp-admin folder is a critical security point with in WordPress. Denying access to this folder (as well as the wp-config.php file) goes a long way to ensuring that your WordPress site is secure.

This can be done in several ways and you may want to do all of them.

Limit access to your wp-admin folder by IP Address: If you know that you are on an IP Address that doesn’t change you can prevent any intruders by blocking every IP but your own. The drawback here is that if you are travelling, are off site or trying to update the site from a location that is not your typical one you will be denied access as well.

This can be done through your .htaccess by using the example code below:
order deny,allow
deny from all
allow from 12.345.67.890
allow from 890.67.345.12

Limit access to your wp-admin folder through password protection: While not as secure as the IP Address method, it can be extremely effective to simply password protect your folder on the server level. This can also build upon the security enhancement of limit access to your wp-admin folder by IP Address by, for example if someone is able to spoof your IP address they still would need to hack your password to break in.

Limit access to your wp-admin folder by hiding it:
There is no reason that your wp-admin folder has to be called wp-admin. Hackers look for this administration folder in this location. One easy way to eliminate hacking of your site and administration area is simply rename the folder to something else. Simple enough?

Protect your wp-config.php file: The password to your database is stored in plain, readable text in your configuration file (wp-config.php). Access to your database gives hackers control over your complete site, so to say you need to protect it is an understatement. The first and most obvious step is to ensure the permissions are set correctly. Some servers set the wrong permissions by default which allows anyone who wants to the ability to read the contents of that file. The permission should be set using SSH or through an FTP client to 640. You can also do this using the File Manager in your hosting control panel (cPanel)

Additionally you can actually move the wp-config.php out of the main WordPress directory and still have everything function properly. This way hackers don’t know where to look for the file. For example if your wp-config.php is located in /public_html/blog/wp-config.php you could move it to /public_html.

WordPress Level Security

Remove the WordPress version number from the META tags: Some hackers target specific versions of WordPress because of known open vulnerability. An easy way to prevent your site from coming up as a target is to simply remove any indicators of the software version.

In older version of WordPress your theme file would have the following code in the header.php that generates a simple tag that outputs the current version:You can prevent this from being an issue by simply deleting that line of code.

Disable the “Admin” account: By default WordPress creates an “admin” account every time you install it. While the passwords are generated randomly it is never a good idea to let people know the login of your most powerful account. Because all WordPress installations have the same username for the master account you are doing just that.

Simply changing the username from admin to something less obvious will improve the security of your site.

This will have to be done through the database as WordPress won’t let you change or remove the account through the administration interface. The account is located in the wp_users table, and you can simply change the account name, display name, etc… to that of your choosing.

Change the WordPress table prefix: All installations of WordPress use the same name for all of the tables on the database. The problem with this is that if a hacker is able to use a SQL injection exploit they know exactly which tables to change data on. If you use an alternative prefix when you install the software this is prevented.

Use Security Keys: WordPress doesn’t require that you take advantage of their “security key” tool that better encrypts cookies, there by better protecting your passwords. Using security keys is a simple process where you generate a key and make some simple modifications to the wp-config.php file. You can generate WordPress security keys on this website: http://api.wordpress.org/secret-key/1.1/

Annie Cushing‘s Must-Have Tools for Spam / Hacking:

Click here to contact Alan for advice if you have been hacked.

The following two tabs change content below.
My Twitter profileMy Facebook profileMy Google+ profileMy LinkedIn profileMy Flickr profileMy Pinterest profile

Alan Straton

Chief Cook, Bottle Washer and Broom Mechanic at MyPE
Passionate about Port Elizabeth and definitely NOT packing for Perth. Alan's ethos is epitomised in the words of Nelson Mandela; "I have fought against white domination and I have fought against black domination. I have cherished the idea of a democratic and free society. If need be, it is an ideal for which I am prepared to die." See more articles by Alan.

Reader Interactions

Comments

    • Thanks for that Addict – you are correct, keeping your core and plugins updated at all times is vital.

      And, if you manage multiple WP sites, a fine way to keep your WordPress sites continuously up to date from ONE Console is InfiniteWP – http://infinitewp.com/ – free with premium add ons if you want.