Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.

But I don't know how this has happened. I do not know where it is happening. What the best practice here? How can I check what has happened and stop it?

EDIT: My host said now that he wasn't sure it was wordpress, but was suspecting it. Do I really need to delete everything and reinstall. This is over 10 sites, and it will be a lot of work.

share|improve this question

migrated from Aug 10 '12 at 12:33

This question came from our site for system and network administrators.

Not strictly related to Wordpress but you could install rkhunter which and etckeeper. rkhunter will perform daily scans for root kits and you can use etckeeper (or git) to track changes to important directories like /etc – javano Aug 10 '12 at 10:46
Or – Tie-fighter Aug 10 '12 at 13:57

Since your server is already compromised,

  • Take your host offlne soon
  • Re-install your CentOS (easier than having to run forensics if you want your server backup soon)
  • Install all updates
  • Install the latest version of wordpress/mysql
  • Harden your server -- turn off unneeded services, disable root login, secure SSH connections, secure wordpress and mysql
  • Recover data from your backup
  • Long term, follow best practices of keeping your OS and applications up-to-date
  • Run periodic security checks such as remote penetration tests, rootkit checks, log audits
  • Review your security policies, firewall rules.

Good luck!

share|improve this answer

Here are some guides:

General WordPress hardening:

More in depth including some server stuff:

If your server itself is secure, most problems are user related, meaning your plugin or theme has malware.

You can run a malware checker:

It's very advisable that you remove plugins, revert to default theme , back-up and clean the DB and do a fresh install.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.