I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. When I went to finish the install after letting it sit like that for a week, I had noticed that someone had found the site, and inputted their own database information, and "took the site over". It was a blank slate, so not much to it.
I removed the wp-config.php file and re-ran the installation with my own values. I then looked around for anything suspicious in the WordPress directory. I had found a shell plugin they installed, labeled "UBH console". I couldn't get the console to run, I got a 404 error.
I assume this shell couldn't get them access out into the machine past the www directory the website was installed in?
In the past, I've always set the WordPress directory permissions with the following command:
chown -R www-data:www-data directory/
Is this the right way to set these directories? Upon further research, a lot of people run this and stay like this, but I've heard to change your permissions after running the installation. Running Debian on my machine.