HI,

 

So iv been building my portfolio site on Wordpress for the last month or so and all I had left to do was some touching up, and then BAM my website has been replaced with This site has been hacked by (some person who really needs to get a life).

 

This is the first time iv really experienced any kind of hacking problems so I am not sure what to do and even how it happened. I built the site on Wordpress (latest version) and I assumed (clearly foolishly) that because its built with Wordpress the security was already taken care of IE measures to stop SQL injection ect.

 

So far i have removed the Wordpress files and database and about to install a fresh copy but how can i find out what might have been comprised such as my admin password and also what maliciouse code he might have left behind in my root folder. Also can some tell me how he might have been able to do this and what I can do in the future to prevent this?

 

Thanks

In cases like these it's a good idea to change all your passwords, including hosting/email logins as well.

 

Finding the point of entry make have been something in WP or it could have been executed via another (insecure) script on your server. In some cases it may be down to poor overall server security which is your hosts responsibility.

 

In any case contact your host as they should be able to help you identify how the hacker got in.

Okay Thanks very much

My WordPress site got hacked the other week as well. I found this article http://semlabs.co.uk/journal/how-to-stop-your-wordpress-blog-getting-hacked which has some interesting tips, especially things like removing "powered by WordPress" as hackers will search for WordPress sites if they know a hack for it.

 

Best of luck getting your website back up and running, but at the end of the day if somebody wants to get access to your website they will.

 

Lee

I used to trawl the internet and break into sites, take them offline, deface them etc. I'll give you a few pointers which should help prevent you from being hacked again and at somepoint i'll write a more indepth article on the matter. but for now:

 

• If your using a popular, open source application such as WordPress, ALWAYS keep it updated. More often than not hackers find vulnerabilities in these scripts before the application developers do so its important to keep your wordpress, joomla, drupal, etc installations as up to date as possible.
  
• Always use a secure password. Make it at least 16 characters in length, dont use any words, make it a random string of uppercase and lowercase letters as well as numbers and symbols. If you find them hard to remember write them down on a piece of paper then hide that piece of paper.
  
• Again, if your using popular open source web software such as wordpress, lookup "secure wordpress" or along the lines on google to find other tips specifically aimed at locking down whatever software you're using.
  
• Once a week or so create a full site backup (including the database as well as your file system) so if you get hacked you'll be able to restore it to a fairly recent version within a matter of minutes. Though I'd find out how they got in first, otherwise they could do it again.
  

I used to trawl the internet and break into sites, take them offline, deface them etc. I'll give you a few pointers which should help prevent you from being hacked again and at somepoint i'll write a more indepth article on the matter. but for now:

 

• If your using a popular, open source application such as WordPress, ALWAYS keep it updated. More often than not hackers find vulnerabilities in these scripts before the application developers do so its important to keep your wordpress, joomla, drupal, etc installations as up to date as possible.
  
• Always use a secure password. Make it at least 16 characters in length, dont use any words, make it a random string of uppercase and lowercase letters as well as numbers and symbols. If you find them hard to remember write them down on a piece of paper then hide that piece of paper.
  
• Again, if your using popular open source web software such as wordpress, lookup "secure wordpress" or along the lines on google to find other tips specifically aimed at locking down whatever software you're using.
  
• Once a week or so create a full site backup (including the database as well as your file system) so if you get hacked you'll be able to restore it to a fairly recent version within a matter of minutes. Though I'd find out how they got in first, otherwise they could do it again.
  

 

Look forward to the in-depth article. Thanks for the tips.