Not sure if you heard but all my websites were hacked and now I have to start from scratch so here is my first post after losing nearly, 1,000 or it could have been more !
Last week all my websites were hacked and apart from losing all my work over the last 5 years it is inconvenient knowing you have to start from scratch. So I just wanted to share the article below fromWordPress.Org for your information to keep you safe and hopefully from being hacked in the future.
Help I think I’ve been hacked
So you’ve carefully installed WordPress, you’ve made it look exactly how you like with a decent theme, you’ve maybe installed some fancy plugins and you’ve crafted some fine posts and Pages. In short, you’ve put a lot of time and effort into your site.
Then, one day, you load up your site in your browser, and find that it’s not there, or it redirects to a porn site, or your site is full of adverts for performance-enhancing drugs. It leaves you wondering,Why would anyone hack my website? What are you supposed to do now?
The entire experience of being compromised can feel devastating, making you wonder why you ever decided to create an online presence. Rest assured though it is not the end of the world, and there a number of practical steps you can take to address the problem once it’s happened, and / or prevent it from ever happening again.
Below we’ll share a number of insights built over the years that will help you think through the post-hack process (i.e., what to do once a hack has occurred).
Some steps to take
- Stay calm.
- When addressing a security issue, as a website owner, you’re likely experiencing an undue amount of stress. It’s often the most vulnerable you have found yourself since being on line and it’s contrary to what every one told you, “Hey, WordPress is Easy!!”
- The good news is that all is not lost! Yes, you might lose some money. Yes, you might take a hit against your brand. Yes, you will recover from this.
- So, yes, take a step back and compose yourself. Doing so will allow you to more effectively take control of the situation and allow you to recover your online presence.
- Scan your local environment.
- The first place you should start with is your local environment. In many cases, the source of the attack / infection begins in your local box (i.e., notebook, desktop, etc…).
- Make sure you run a full anti-virus/malware scan on your local machine. Some viruses are good at detecting AV software and hiding from them. So maybe try a different one. This advice extends to both Windows, OS X and Linux machines.
- Can’t Log Into Your WordPress Admin Panel
- This happens more often than you might think. It’s not a reason to panic. To get this going you can follow some very good steps hereReset Your Password
- You can leverage tools like phpMyAdmin and Adminer to log into your database directly, bypassing your WP-ADMIN and resetting your user in the users table.
- If you don’t want to mess with password hashes or can’t figure it out, simply update your email and go back to wp-admin, click forgot password, and wait for the email.
- Scan your website.
- There are various ways to do this. Today there are a number of greatplugins in the repo that make this process easier.
- You also want to unhide all the files and folders, to include extensions for all files files. You can run a search for *.exe files, sort them by size, most malicious code is executable and is lesser than 5MB usually but can be > 5MB. Also not every .exe under 5MB is malicious, delete the known viruses/worms/autoruns, make a list of all suspected executables, check against online database.Caution: Make sure you don’t delete the system files. Securelist has an article on how to find an infected file.
- You want to be mindful of the various types of symptoms and how they affect your website and it’s visitors. For instance, malicious redirects can often be found in files like .htaccess, and index.php at the root of your website. While others will focus on the wp-content/themes directory targeting index.php, header.php, footer.php and functions.php. These are the more simple variations ofcourse.
- Be Mindful of Website Blacklists.
- Google Blacklist issues can be detrimental to your brand. They currently blacklist somewhere in the neighborhood of 9,500 to 10,000 websites a day. This number grows daily. There are various forms of warnings, from large splash pages warning users to stay away, to more subtle warnings that pop up in your Search Engine Result Pages (SERPs).
- Although Google is one of the more prominent ones, there are a variety of other blacklist entities like Bing, Yahoo and a wide range of Desktop AntiVirus applications. Understand that your clients / website visitors may leverage any number of tools and any one of them could be causing the issue.
- At a very minimum, you want to take some time to create an account with Google Webmaster tools and
- If you’re currently infected you’re going to want to look at a number of things and when you’re done you’ll want to follow Google’s steps for reconsideration.
- Check with your hosting provider.
- The hack may have affected more than just your site, especially if you are using shared hosting. It is worth checking with your hosting provider in case they are taking steps or need to. Your hosting provider might also be able to confirm if a hack is an actual hack or a loss of service, for example.
- One very serious implication of a hack these days is around Email blacklisting. This seems to be happening more and more. As websites are abused to send out SPAM emails, Email Blacklist authorities are flagging the website IP’s and those IP’s are often associated with the same server being used for email. The best thing you can do is look at Email providers like Google Apps when it comes to your business needs.
- Improve your Access Controls.
- You will often hear folks talking about updating things like Passwords. Yes, this is a very important piece, but it’s one small piece in a much larger problem. We need improve our overall posture when it comes to access control. This means using Complex, Long and Unique passwords for starters. The best recommendation is to use a Password Generator like those found in apps like1Password and LastPass.
- Remember that this includes changing all access points. When we say access points we mean things like FTP / SFTP, WP-ADMIN, CPANEL (or any other administrator panel you use with your host) and MYSQL.
- This also extends beyond your user, and must include all users that have access to the environment.
- Change your secret keys.
- If they stole your password and are logged in to your blog, even if you change your password, they will remain logged in. How? because their cookies are still valid. To disable them, you have to create a new set of secret keys. Visit the WordPress key generatorto obtain a new random set of keys, then overwrite the values in your wp-config.php file with the new ones.
- Take a backup of what you have left.
- If your files and database are still there, consider backing them up so that you can investigate them later at leisure, or restore to them if your cleaning attempt fails. Be sure to label them as the hacked site backup, though…
- Find and remove the hack.
- This is perhaps the hardest part of this entire list and the part that will require the most work. It will come down to your individual technical knowledge and insight around website hacks. To get you started though below are a few resources that will get you going in the right direction:
- Donncha wrote a good article on what to do if you suspect a hack, it is well worth reading through and acting on, as it goes into more depth than this page.
- You can also read How to clean your hacked install
- Sucuri has put out a number of technical posts that will help –Removing malware from a WordPress blog – which explain in details some steps you might need to take.
- Additionally you can leverage that post that shows you some tricks of the trade to help you get to the bottom of the issue – FTP Tips and Tricks to Help you Clean Your Website.
- One obvious response to a hack is to delete everything and start from scratch. Tempting, yes, but highly unrealistic. What you can do however is reinstall certain elements of the site with little regard to impacting the core of your website. You always want to make sure you reinstall the same version of software your website is using, if you choose an older or newer one you’re likely to kill your website. When reinstalling, be sure not to use the reinstall options in your WP-ADMIN. Use your FTP / SFTP application to drag and drop the versions. This will prove much more effective in the long run as those installers often only overwrite existing files, and hacks often introduce new files..
- Hackers can use your .htaccess to redirect to malicious sites from your URL. Look in the base folder for your site, not just your blog’s folder. Hackers will try to hide their code at the bottom of the file, so scroll down. They may also change the permissions of the .htaccess file to stop newbies from editing the file. Change the permissions back to 644.
- Leverage the Community
- We often forget but we’re a community based platform, this means that if you’re in trouble someone in the community is likely to give a lending hand. A very good place to start if you’re strapped for cash or just looking for a helping hand is the WordPress.org Hacked orMalware forum.
- Another very good resource is StopBadware’s Badwware Busters forum. This is a nonprofit that is committed to helping website owners just like you.
- Using version control?
- If you are using version control, it can be very handy to quickly identify what has changed and to rollback to a previous version of the website. From the terminal or command line you can compare your files with the versions stored in the official WordPress repository.
$ svn diff .
Or compare a specific file: $ svn diff /path/to/filename
- Consider restoring a backup
- If you restore from a known clean backup of your WordPress Database, and re-upload your backed up WordPress plugin and theme files through FTP or SFTP, that will ensure that all those bits are clean of malicious code are gone. At the very least …
- What? No backup?
- You have two very grim choices. You can start a new fresh site from scratch. You can attempt to manually locate and remove the malicious code. Even the chances of an expert being able to completely clean your site are poor. Someone can spend days looking through files, removing small snippets of hacker code. If they miss one bit, the entire hack can be replaced by the hacker in a second once the site goes online. Read about backdoors to get an idea of what you’re up against. If you’re reading this and have not yet been hacked and have not backed up your site, go do it NOW!
- Replace the core WordPress files with ones from a freshly downloaded zip.
- Replacing all your core files will ensure that they are no longer left in a hacked state. If you didn’t already restore backup copies of your plugin and theme files, replace them too.
- You might also want some tips on how to think through the process of creating a good backup strategy. There are a number of steps to take into consideration, so be sure top lan accordingly.
- Update!
- Once you are clean, you should update your WordPress installationto the latest software. Older versions are more prone to hacks than newer versions.
- Change the passwords again!
- Remember, you need to change the passwords for your site aftermaking sure your site is clean. So if you only changed them when you discovered the hack, change them again now. Again remembering to use Complex, Long and Unique passwords.
- Secure your site.
- Now that you have successfully recovered your site, secure it by implementing some (if not all) of the recommended security measures. Learn more about where WordPress is most vulnerable.
- Moving forward you’ll want to better Understand how Websites Get Hacked and use that knowledge to better configure your environment to reduce the risk of future compromises.
- Forensics – Identify what happened…
- Once your site is secured, check your site logs to see if you can discover how the hack took place. Open source tools like OSSECcan analyze your logs and point to where/how the attack happened. Here is a nice little write up that walks you through the process of using OSSEC for your Website Security.
- Here is another great example of how logs can be leveraged to understand what the attacker was up to.
- There are also a number of other examples including this one in which a user was able to outline the various steps they took to identify how an attack happened.
- Keep regular backups.
- Now that the nightmare is over, start keeping regular backups of your database and files. If this ever happens again, all you will need to do is restore from the last known clean backup and change your passwords and secret keys.
P.S. – For $1 why not try out our all in one tool suite, saving you almost $500 a month – for 7 days it has to be worth trying – doesn’t it? Click HERE for more info …………… We can help you stay focused ………….
P.P.S. – Click the link and get a 3 day $2 trial period with My Lead System Pro===>>> HERE
P.P.P.S. – PS: I’ve been able to get you FREE Lifetime Membership in Instant Squeeze Page Generator –
the one site where you can build killer squeeze
pages with a click and play wizard!
Comments
Thanks for sharing this, Merle ...very enlightening! Will share so more will see. Blessings!
thank you Terri and thought it appropriate to post this after what happened to me. It has been so long since I set my blogs up I have forgotten what plugins to use and how to set up my contact forms etc !! Spending a lot of time on google trying to get answers !!
Wow powerful post and very beneficial for bloggers to know this. I will be sharing this on the Syndication Express blog for many more bloggers/website owners to read. Thanks for publishing this post in the SE community.