Nowadays, a lot of bots are scanning Internet to find security breaches to abuse of servers. As WordPress is one of the most used CMS, most of attacks attempts are done using WordPress flaws.
If you site get hacked, you have to find how it happened in a first time
Most of WordPress attacks are aiming wp-config.php through adminpages, upload, loginpages, plugins to collect informations about your configuration and how to exploit it.
One of the biggest security is to protect your wp-config.php:
<Files wp-config.php>
order allow,deny
deny from all
</files>
Some exemples of requests found in logs: (useful info linked to attacks are in logs)
/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
- showbiz plugin breach attack:
/wp-content/plugins/showbiz/temp/update_extract/revslider/get.php
/wp-login.php (auth fail flood)
A lot of WordPress expert sites warn about some basic security flaws:
For example: http://codex.wordpress.org/Hardening_WordPress
Keep your WordPress up to date
Updates are made to fix stuff, but in this stuff, there is thing about security, so try to get an eye on updates (subscribe to WP newsletter, or try to add system to autoupdate it)
Once the breach is fixed, you can unlock your site from hacked site on http://google.com/webmasters/hacked (thanks @Zonk for the link)
Some more: Some Apache advice to prevent attacks:
log in a special files request on wp-config/wp-login/wp_admin files
SetEnvIfNoCase Request_URI "wp-config\.php|\/wp-admin\/|wp-login\.php" securitylog
CustomLog ${APACHE_LOG_DIR}/security.log vhost_combined env=securitylog
redirect useless trafic
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule .* - [F]
limit request methods to GET, HEAD and POST
RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST)$
RewriteRule .* - [F]
find a human readable logviewer
