Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -3 down vote favorite

I am working in web hosting company so my job is to fix clients problem, one of the biggest problem we are facing right now is that our only word press customer site got hacked 'not one all of them', and we have around 1200 word press customer that are hacked.

Most customer site's are up to date and they have around 4 to 5 security plugins, and we have tried every security plugins on the planet earth, and we have also tried manually editing the sites ( manually secure ). All other CMS are working fine like joomla and custom made site's.

How can we fix the hack issue ? Any suggestion what shall we have on php secrity ?

one of the shocking thing is that my site is on the same server and i haven’t got hacked !!. i have no security plugins installed but my wp-config.php file is in my home directory so its not in 'public_html' ( cpanel )

share|improve this question
i will post the hacked sites....... – Qasim Dec 11 '12 at 16:38
Welcome to Security Stack Exchange - unfortunately, as AJ and Everett have pointed out, this one is not really answerable without an awful lot more information. Really, you need to be thinking about incident management and diagnosis – Rory Alsop♦ Dec 11 '12 at 17:05
1  
Run WordPress securely? Simple. Don't run WordPress. Failing that, don't use any 3rd-party themes/plugins/etc. Failing that run your Apache sites in a chrooted jail and disable all of the fun functions in PHP‌​. But basically all that does is make it so that attackers can only hit the one weak site that the customer won't upgrade past WPv2, but it's an improvement. Oh yeah, force all your customers to update regularly. – Sammitch Dec 11 '12 at 23:18

closed as not a real question by Polynomial, Rory Alsop♦ Dec 11 '12 at 17:05

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 0 down vote

This is a MUCH bigger problem than you could solve here. Do you know what the vector of the attack was? HOW were the sites hacked? Just trying anything to fix it is an exercise in futility. You REALLY need to call in a professional (someone that does security for a living).

What if the problem was a weakness in your web server? What if it's the database itself that got attacked? It could have been the application, what WordPress version are you running? It's a good observation that your wp-config.php isn't in your public_html cpanel. Have you tried moving other peoples?

What if the attack installs a backdoor permanently? Do you know how to parse the database and find it? Were you port scanned before you were attacked? What other activity do your logs show? What kind of security equipment do you have in place (Intrusion detection, Firewalls, etc). These things can help narrow things down (what can or can't have happened).

share|improve this answer
1  
The sites are hacked mostly by SQL injection and some java script and i think its 'base64'... as i said above none of other php site got hacked...may be its problem in webserver for wordpress...no we have check everything in the server there is nothing ... for wp-config.php we cannot do that with customers cauzz if some thing not work they will..... – Qasim Dec 11 '12 at 16:31
Are there any SQL updates? Have you tried some of the things here: owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet – Everett Dec 11 '12 at 16:40
up vote 0 down vote

Without identifying the attack vector there is nothing that anyone is going to be able to tell you to help. Perhaps if you offered more information about what the hacking did it might be helpful. Were particular files changed? Information in the DB? Weird posts? What were the symptoms? Were the sites running on the same instance of WP? If not, were the DBs isolated? Were they using the same DB username and password? It sounds like something was most likely done wrong in the configuration of your server, but it's really hard (impossible) to tell from the details you have provided.

share|improve this answer
The sites are hacked mostly by SQL injection and some java script and i think its 'base64' – Qasim Dec 11 '12 at 16:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.