Website getting hacked

[the_quick]

Hi Guys

 

Hope you can help.

 

Our adult education get constantly hacked, we change passwords, remove all dodgy files, what ever we can find, but after few days website is hacked, they just put own index.php. They leave all the content undamaged, but some files as well, like cpanel cracker - I usually upload whole website again, which is clean. But I have no idea how we can stop that. I have very limited knowledge about website hacking and website in general - someone designed website for us.

 

We use easyspace for hosting, website is done with wordpress and third party theme. Last time I have change all passwords, cpanel, ftp, wordpress admin password, change secret keys as well - and today after a week hacked again.

 

Can anyone help?

 

- Kris

[north-ict]

Have you you changed the actual username from admin to something else for the website? IIRC read something about doing that for security, correct me if I am wrong guys.

[AngryTechnician]

1. Check cPanel is up to date

2. Check Wordpress is up to date

3. Check plugins are up to date, disable any you aren't actively using.

4. Check whether your third party theme is up to date (yes, even themes can have a security vulnerability). If it is a publicly available theme, can you name it/give a webpage for it?

[the_quick]

Cpanel, we have to check with hosting guys, but all other things were just updated few weeks ago, and we thought it will help. All plugins and theme updated as well.

 

The webpage address: claverham-education.co.uk , I'm fixit it now, so hackers website is gone.

[creese]

Install this plugin and go through the 'traffic light' suggestions to lock your site down.

 

WordPress › Better WP Security « WordPress Plugins

[creese]

There is also a recent security update to Wordpress, now 3.5.2.

[Marci]

Is this a shared or dedicated host? First step is to make sure you've changed the MySQL User's password, and that your admin account for Wordpress doesn't use 'admin' as the username. Edited June 24, 2013 by Marci

[free780]

Silly question is ftp secure ftp?

[the_quick]

I think hostings is not on dedicated servers.

 

Normal FTP, can't connect with SFTP, is either easyspace don't offer it or our proxy settings blocks it, but I think they just do not offer it.

[Marci]

If you're not on a dedicated host you should contact EasySpace support and notify them of the breach, as it may have compromised other accounts on the server.

[the_quick]

did that already, telling the truth they are not brilliant

[creese]

did that already, telling the truth they are not brilliant

 

Move it. I can recommend Vidahost, they will move the site for you. They are cheap too.

[X-13]

Is it a new index.php or is yours being modified?

 

If it's the latter, your need to sanitise your inputs. [in other words, it's the comments or the search bar. Possibly the username/password boxes, but I doubt it.]

 

 

I took a while to reply because I was poking your website a bit.

[the_quick]

playing with the site now.

[soveryapt]

I think your problem might be the thumb.php script in your theme itself.

 

There was quite a big security issue surrounding Tim Thumb as it's called, so much so that WooThemes removed it from all of their themes to make sure security was good. I would suggest checking this over as I know it compromised a few of my clients sites that I host, but a refresh of a recent backup, combined with the new database and removal of the thumb.php script worked a treat. Doesn't look like WPLocker (or wherever you got the WPStore theme from) has updated that though.

 

Seems to be in /v7/wp-content/themes/WPStore/thumb.php

 

Worth a check.

[the_quick]

Thanks, just deleted it.

 

Playing with that security plugin.

 

X13 not sure I understand what you said, the index.php is now how it should be. Just updated everything

[X-13]

X13 not sure I understand what you said, the index.php is now how it should be. Just updated everything

 

I mean when it's hacked.

 

Is the index.php on the server a new hacked version or has the content been rewritten to include the hack?

[soveryapt]

Thanks, just deleted it.

 

Playing with that security plugin.

 

X13 not sure I understand what you said, the index.php is now how it should be. Just updated everything

 

You need to make sure you remove references to it in your theme as well, otherwise it will throw up errors when people try to load pages whilst it tries to find the script to run to get the thumbnails. It might be worth checking you have the latest version of the theme installed as well as they might have removed it from a newer version of it.

 

One thing I always recommend with Wordpress is well is the use of Child Themes, so any customisations you make are not lost if you do a theme upgrade and means you don't have to run around patching things. Check out Child Themes « WordPress Codex for more info on what they are / how to do it / etc.

[AngryTechnician]

Rather than just removing it (which could break things as @soveryapt suggests), you could use a plugin like this to check if it is vulnerable and update it if required: WordPress › Timthumb Vulnerability Scanner « WordPress Plugins

[the_quick]

Thanks guys.

 

They always replace index.php with own, either in root folder or in v7 folder. I have backup of the site, which is clean, as before they left few php files in random folders, last one I have found was cpanel cracker. So each time I just delete all content and upload backup. Website is not updated very often and it is being done by adult education staff, so sometimes pictures are missing and such.

I have not designed my self and no way expert in webdesign, we hired someone who we know well. We already suggested child themes, we looking at it now, but something is not working as it should when implemented - site just crashes and goes blank.

Work in progress

[the_quick]

I think I got on something here. I have used suggested plugging for security. One of the option s create quite big .htaccess file with lots of options. I think it stops hackers, but as well stop to display images to not logged in people. I removed that file and few hours later site was hacked. So restored it and put .htaccess back online. Now working on it content, to make pictures on posts visible for everyone. Just need to find good tutorial on use of htaccess

[soveryapt]

I think I got on something here. I have used suggested plugging for security. One of the option s create quite big .htaccess file with lots of options. I think it stops hackers, but as well stop to display images to not logged in people. I removed that file and few hours later site was hacked. So restored it and put .htaccess back online. Now working on it content, to make pictures on posts visible for everyone. Just need to find good tutorial on use of htaccess

 

Are your permissions all set ok on your site as it sounds like they either have access to your FTP or Wordpress Admin, a dodgy script somewhere on the site or that permissions have gone funny on your install.