Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.

But I don't know how this has happened. I do not know where it is happening. What the best practice here? How can I check what has happened and stop it?

EDIT: My host said now that he wasn't sure it was wordpress, but was suspecting it. Do I really need to delete everything and reinstall. This is over 10 sites, and it will be a lot of work.

share|improve this question
    
Not strictly related to Wordpress but you could install rkhunter which and etckeeper. rkhunter will perform daily scans for root kits and you can use etckeeper (or git) to track changes to important directories like /etc –  javano Aug 10 '12 at 10:46
    
Or tripwire.org –  Tie-fighter Aug 10 '12 at 13:57
add comment

migrated from serverfault.com Aug 10 '12 at 12:33

This question came from our site for professional system and network administrators.

2 Answers

Here are some guides:

General WordPress hardening: http://codex.wordpress.org/Hardening_WordPress

More in depth including some server stuff: http://wpsecure.net/secure-wordpress/

If your server itself is secure, most problems are user related, meaning your plugin or theme has malware.

You can run a malware checker: http://wordpress.org/extend/plugins/wordfence/

It's very advisable that you remove plugins, revert to default theme , back-up and clean the DB and do a fresh install.

share|improve this answer
add comment

Since your server is already compromised,

  • Take your host offlne soon
  • Re-install your CentOS (easier than having to run forensics if you want your server backup soon)
  • Install all updates
  • Install the latest version of wordpress/mysql
  • Harden your server -- turn off unneeded services, disable root login, secure SSH connections, secure wordpress and mysql
  • Recover data from your backup
  • Long term, follow best practices of keeping your OS and applications up-to-date
  • Run periodic security checks such as remote penetration tests, rootkit checks, log audits
  • Review your security policies, firewall rules.

Good luck!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.