Anyone have experience and advice to locate the source and stop an ftp hack on my client's Wordpress site hosted on BlueHost? The hackers were able to do the following:

  1. Create multiple ftp accounts with usernames like ss-ee4f8275917dfe28 etc. pointing to folders /tmp/simplescripts/ and /public_html/
  2. Upload php files with names like MMprobe-N5ayJ.php into the public_html folder
  • 1
    We cannot possibly know the source of an attack by looking at what they did afterwards. – schroeder Jul 19 '19 at 12:11
  • Contact a professional to aid you. – MechMK1 Jul 19 '19 at 17:48

The best scenario would be to take the last backup of the website and just re-create it fresh on a new server. You should contact their support for help. There could possibly be rootkits and other hidden stuff inside your application files, which could take a lot of time to weed out.

To prevent FTP attacks

  • use latest FTP service version
  • use strong username, password
  • setup fail2ban on FTP to prevent brute-force attacks
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.