My WordPress Website Has Been Hacked!

WordPress websites could be many of the most vulnerable for getting hacked as a result of popularity of the platform. Quite often when people touch base for help, it’s because their site was hacked once, they fixed it–and then it had been hacked again.

“Why did my WordPress website get hacked again when i fixed it?”

When your WordPress site gets hacked for a second time, it’s usually because of backdoor developed by the hacker. This backdoor allows the hacker to bypass the standard procedures so you can get into your site, getting authentication without you realizing. On this page, I’ll explain how you can find the backdoor and fix it in your WordPress website.

So, what’s a backdoor?

A “backdoor” is a term referring to the technique of bypassing normal authentication to find yourself in your site, thereby accessing your site remotely without you even realizing. In case a hacker is smart, this is actually the first thing that gets uploaded when your site is attacked. This allows the hacker to possess access again in the foreseeable future even after you discover the malware and remove it. Unfortunately, backdoors usually survive site upgrades, so the site is vulnerable and soon you clean it completely.

Backdoors may be simple, allowing a user only to create a hidden admin user account. Others are more complex, allowing the hacker to execute codes sent from the browser. Others have a whole interface (a “UI”) that provides them the ability to send emails from your own server, create SQL queries, etc.

Where is the backdoor located?

For WordPress websites, backdoors are commonly located in the next places:

1. Plugins – Plugins, especially out-dated ones, are a fantastic place for hackers to cover code. Why? Firstly, because people often don’t think to log into their site to check on updates. Two, even though they do, people can’t stand upgrading plugins, since it takes time. It can also sometimes break functionality on a niche site. Thirdly, because there are thousands of free plugins, a number of them are easy to hack into in the first place.

2. Themes – It’s not so much the active theme you’re using however the other ones stored in your Themes folder that can open your site to vulnerabilities. Hackers can plant a backdoor in another of the themes in your directory.

3. Media Uploads Directories – Most people have their media files set to the default, to generate directories for image files based on months and years. This creates a variety of folders for images to be uploaded to–and many opportunities for hackers to plant something within those folders. Because you’d rarely ever check through all those folders, you wouldn’t find the suspicious malware.

4. wp-config.php File – that is one of the default files installed with WordPress. It’s one of the first places to check when you’ve had an attack, because it’s one of the common files to be hit by hackers.

5. The Includes folder – Just one more common directory because it’s automatically installed with WordPress, but who checks this folder regularly?

Hackers also sometimes plant backups to their backdoors. So when you may remove one backdoor… there could be others living on your server, nested away safely in a directory you never look at. Smart hackers also disguise the backdoor to check such as a regular WordPress file.

What can you do to clean up a hacked WordPress site?

After reading this, you may guess that WordPress is the most insecure type of website you could have. Actually, the latest version of WordPress does not have any known vulnerabilities. WordPress is continually updating their software, largely because of fixing vulnerabilities when a hacker finds a way in. So, by maintaining your version of WordPress up to date, you can help prevent it from being hacked.

Next, you can try these steps:

1. It is possible to install malware scanner WordPress plugins, either free or paid plugins. That you can do a seek out “malware scanner WordPress plugin” to get several options. A number of the free ones can scan and generate false positives, so that it can be hard to learn what’s actually suspicious unless you’re the developer of the plugin itself.

2. Delete inactive themes. Remove any inactive themes that you’re not using, for reasons mentioned above.

3. Delete all plugins and reinstall them. This could be time-consuming, but it wipes out any vulnerabilities in the plugins folders. It’s a good idea to first create a backup of your site (there are free and paid backup plugins for WordPress) before you begin deleting and reinstalling.

4. Create a fresh .htaccess file. Sometimes a hacker will plant redirect codes in the .htaccess file. It is possible to delete the file, and it’ll recreate itself. If it doesn’t recreate itself, you can manually do that by visiting the WordPress admin panel and clicking Settings >> Permalinks. Once you save the permalinks settings, it will recreate the .htaccess file.

5. Download a fresh copy of WordPress and compare the wp-config.php file from the new version to the one in your directory. If there’s anything suspicious in your current version, delete it.

6. Lastly, to be completely sure your website does not have any hack (outside of using paid monitoring services), it is possible to delete your site and restore it to a date that the hack wasn’t there from your own hosting control panel. This can delete any updates you have made to your site from then on date, so it’s not just a great option for everybody. But at the very least it cleans you out and peace of mind.

In the future, you can:

1. Update your admin username and password. Create a new user with Administrator capabilities, then delete the old one you were using.

2. Use a plugin to limit login attempts. This can keep someone locked out after a specific amount of attempts to obtain in.

3. Password protect the WP-admin directory. This would be done through your website hosting control panel. If Hacked website service uses cPanel, this is easily done with a couple of clicks. Contact your host to determine how exactly to password-protect a directory or do a search for it on your own hosting company’s website.

4. Create regular backups. By burning your site regularly, you know you will have a copy to restore the website with if it could get hacked. You can find free and paid plugins open to help with this particular, or you may be able to create a backup of the complete account from your own hosting control panel. Or, though slower but still an option, you can download the complete site via FTP software.

When it comes to security, it can help to go on it seriously. Backing up your website is among the best things you can do, because your webhost may not do this for you. Some may offer backups/restore features if you activate them, plus some may create random backups every couple of weeks. But you don’t want to rely on the host because this isn’t within their scope of services. To become more certain, you can utilize paid malware monitoring services and plugins in order to watch your site and that means you don’t have to worry about it.