Sitelock and anti malware by hackers on wordpress
-
Dealing with my first client that had hacker situations on her wordpress... and she just got into sitelock. I am curious what everyones thoughts are and what other plug ins you suggest. I have used and suggested things like wordfence, bulletproof security, wordpress security, things like that. I just don't want her to get into a scam and I don't know enough about it.
-
Well isn't big deal at all. You need to:
- investigate error 500. Usual this is part of "door knocking". You should see who and what is going to do just for error 500. Watchout for /wp-content where themes and plugins are. Also /wp-admin and /wp-include where WP core is.
- investigate 404 errors. This is part 2 of "door knocking". Often happens when vulnerability doesn't exist. Like timthumb or revSlider - someone still knocking on few days. (this was vulnerability that leave more than 100k sites with PHP execution)
- investigate strange redirects - 301, 302. IF site is working perfect you shouldn't see any redirects. But if you're WWW and someone link w/o WWW you can see redirect. Also WP comes with internal redirector for broken urls, can be typo mistakes. But more interesting are vulnerability so any strange activity can be easy seen.
- investigate strange traffic - can be POST or GET to /wp-content/plugins or /wp-content/themes PHP code. In perfect world only WP can call them. Or using WP-AJAX. Direct calling to code isn't recommended anymore.
- investigate bot traffic - like 2000 requests for 30 mins to wp-login.php This is one example - you can easy see them because one IP can do lot of requests.
- you need to check file structure - new/changed files can be warning that something was happened. I like GIT/Mercurial or SVN because they can check quick folders for changes. Bad news - you need SSH access and some dev skills. If you don't have SSH then you can download whole site and compare it with original copy. I can recommend WinMerge (free and open source) tool for comparing files/folders in Windows. If you're on Mac just as me you can use FileDiff (free) or Kaleidoskope (paid tool, trial available). There is also paid multi platform tools as Beyond Compare, Araxis Merge, Delta Walker and few more.
- you need to make HTTP password to sensitive portions of WP. Also you must do some hardening of WordPress installation. This is covered in Codex here. For example try to login on mine site: http://www.mobiliodevelopment.com/wp-admin/ Good luck!
- you can implement additional security in .htaccess like 5G firewall here. Or you can implement WAF (web application framework) like modsecurity.
I think that i cover most of mine daily routine inspections. Look scary but when you get experience will took less than 5 minutes per site.
-
That is great advice! That helps! Where and how can I investigate the web attacks? Esp through wordpress. It is out of my expertize. I can try via IP ... but IP can be bounced around with different towers. Or I could contact the server.
-
I have talk about WordPress security before month ago in WordPress Bulgaria 2015.
So very short - if you have update to latest versions of core, plugins and themes and they're stable you don't have anything to worry about.
The problem is when some of them comes with non well checked code - most plugins or themes. This mean that if there is some vulnerability you can be infected over and over. Same can happen if you download from illegal sites plugin/theme with some added code as vulnerability. Don't think that "this won't happen on me" because this is one of most frequently way to distribute malware to users.
All that security layers add extra PHP code that need to be executed and slow down site. They also bring issues to some users. I never forget when few months ago ping in Twitter some site that i can reach their site from Bulgaria. Yes - due settings in their "security" plugin.
That's why you need few ways:
- you need to use only plugins/themes from original author. If they're on WordPress.org then this is preferred. This doesn't mean that they can't have some vulnerability, but you just minimize chance
- you need to update them regular
- you need to use only proven plugins/themes in your practice. I believe that plugins with 100k installs is tested than plugin with 10 installs
- you always should keep backup of site and it's database local on your computer. In hacked site case - you just need to restore from backup for 5-10 mins
- keep backups on regular basis - can be plugin or manually. There you can diff backups for changes very quick
- you need some skills to investigate web attacks using checking web server log files. I do this on daily basis for mine most important sites. If some IPs or user agents doesn't follow rules - deny their access
- in case of hack - keep archive of hacked site and then recover. One of huge mistake more novices make is to trying to clean site. Most of malwares keep somewhere in WP "dead hand" and they're back later. Experts (like me) need lot of time to find and disabled them. With backups - this is piece of cake
- If you follow this but keep hacked... then think out of box - maybe plugin have unknown vulnerability or theme. Sometime other sites/scripts working on same hosting account can infect you. I have even seen infected whole hosting company on server level. Then you need expert assistance. You can find this in WP forum and/or in your hosting provider.
- Some hosting providers provide extra service as - WordPress hosting. This is often high-speed solution with added extra level of security on server level. I can recommend SiteGround, WPEngine or nestify.io
List is really long and boring. But if you follow all these rules - you don't need "security" plugin. It's critical for you to know what's happen in WP and when this is happening. I often can see people that doesn't know that they're infected but they doesn't have backups or archives. This make mine job longer and expensive.
PS: I know that checking site on daily basis sound little bit scary. But take me maximum 5 minutes per site for day.
-
Along with BulletProof, Wordfence is one of the highest rated, and most used security plugins for WordPress.
However her hacking issue was likely the cause of a security vulnerability in one of her WordPress plugins. We often see this with clients that do not update their plugins, or have plugins that haven't had updates in ages. Some plugins are created as a front solely to steal data or have another security vulnerability.
One of the best ways to combat this is to #1. Make sure you update your plugins regularly and #2. Only download plugins that are highly rated and are updated regularly.
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Are there definite benefits of the jetpack firehose for wordpress
Is there any research or detailed review of whether the jetpack wordpress firehose has a definite benefit for seo? https://wordpress.org/support/topic/enhanced-distribution-to-where/
Content Development | | jezweb0 -
Shopify Blog vs Wordpress
We are moving our Ecommerce site to Shopify. Currently we run our blog on Wordpress and I'm wondering if anyone has an opinion on using the Shopify blog vs Wordpress?
Content Development | | Glaze0 -
Wordpress Back Up
Anyone have any recommendations for a stable/secure back up plug in for wordpress? Thanks MoZzers -Chenzo
Content Development | | Chenzo0 -
Starting a brand new blog today - Is it still Wordpress?
Hi I started a blog in 2006 on Blogspot, then everyone moved onto Tumblr and Wordpress, but in August (just) 2013, what should I be starting my brand new blog on? I dont want to have to migrate in a matter on months.
Content Development | | xoffie0 -
How many categories should you have within a blog / Wordpress Site for SEO?
Hi Guys I am just wondering whether or not for SEO purposes it is better to have a small number of categories for your blog posts to fit into as opposed to numerous ones. The reason I ask is that I have one site which is fairly new to the search engines - 8 months old which has 7 general categories within the blog for instance "rail contractors", "railway construction" "airport construction" etc I have another site which is 10 years old which has built up 25 different types of categories for instance brand design, brand development, brand management (i guess you could put all these under 1 category "branding"? We've been writing lots of press for both sites... yet the younger site is getting more coverage on Google page 1. Would this be because the blogs / press are more concentrated under a specific category as opposed to being spread thinly throughout the site? Any help would be appreciated. Debs 🙂
Content Development | | lethalmarketing0 -
Duplicate content for manually setup blog and wordpress blog
We have a website where the ecommerce will not allow us to host blog. So we created our own manual blog page setup. Will this flag duplicate content on Google? http://www.homesupershops.com/blog and http://www.homesupershops.com/blog-july have same content. How come on a word press the same content on http://www.vizionseo.com/blog/ and http://www.vizionseo.com/blog/2011/05/how-can-your-business-rank-high-on-google-maps/ does not flag duplicate content?
Content Development | | VizionSEO990 -
Fixing Wordpress URLs
I just redid our blog and I am using permalinks. I have the custom structure set to /%year%/%postname%/ and catagory - blank. When I run the XENU Link Slueth, it shows all my blog urls as broken, but the links work fine. However the url structure is www.example.com/2010/10/20/ and so on. I am worried about duplicate content too. Do you know how I can fix the url structure so only 1 or 2 urls are used?
Content Development | | hfranz0 -
Are you sure moving a wordpress blog to a main website is a good idea?
Sorry to ask this question again but I left out some background info...... My blog sits at www.gardenbeet.wordpress.com I have been using the blog as my main linking page for my main website at www.gardenbeet.com - the blog links to relevant sites in both blog articles and on the side of the blog. The blog links to industry websites that in turn link to my main website at www.gardenbeet.com. If I was to move the wordpress blog to my own domain will my mainwebsite loose its strength. Will all those blog links pour my link juice out of my website? Will the current three way links become two way links and thereby lesson their linking importance? Is the previous recommendation (combine the blog and the main website) still the best course of action? Should I keep the two sites or perhaps close entries on the existing blog and start another on my own domain? thanks for your time AGAIN
Content Development | | GardenBeet0