1

After the second hack, we did all the necessary things written here - https://wordpress.org/support/article/hardening-wordpress/ , https://security.stackexchange.com/a/180925 and we also changed the file permission (wp-config.php to 400). We added WordFence, Limit Login and Bad Robot Black hole plugin to secure the installation.

The hack redirects my site to another site.

We run WP 5.4.1 with the theme https://gracethemes.com/themes/music-wordpress-theme/. All plugins and theme are updated.

How can I prevent future attacks?

Added below in wp-config.php

define('DISALLOW_FILE_EDIT', true);

Added below in htaccess

# Block WordPress xmlrpc.php requests

<Files xmlrpc.php>

order deny,allow

deny from all

allow from 123.123.123.123

</Files>

<files ~ "^.*\.([Hh][Tt][Aa])">

order allow,deny

deny from all

satisfy all

</files>

<files wp-config.php>

order allow,deny

deny from all

</files>

# Block the include-only files.

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteBase /

RewriteRule ^wp-admin/includes/ - [F,L]

RewriteRule !^wp-includes/ - [S=3]

RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]

RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]

RewriteRule ^wp-includes/theme-compat/ - [F,L]

</IfModule>
8
  • 1
    Perhaps they left a backdoor, or one of the plugins has a vulnerability. Maybe the credentials of the server are easy to guess or stolen (wp-admin, ftp or mysql)? Many things can go wrong here. Do you have access to the server logs? There you should find some hints about how the attackers got in. – roy.stultiens May 4 '20 at 19:41
  • All passwords are super hard to guess like 345^#!Ad4104# type. Auto gen by WP. When an admin logs in my site, I will get email alert from WordFence which I did not get. But all my plugins are updated. – cilapo1541 May 4 '20 at 19:55
  • Should I use MalCare or Sucuri or WordFence to clean the site? Which is better? – cilapo1541 May 4 '20 at 19:55
  • You say the hacker is redirecting your site to another site. Do you know how they are doing this redirection? – hft May 4 '20 at 19:56
  • 2
    If they have a backdoor process listening on your server they can just keep using that same backdoor to get back in and re-hack your site. Just because some little scanner app says it is clean is meaningless since the backdoor malware might employ a process hiding component to make it invisible to the malware scanner. The only way to be sure is to wipe and reinstall. – hft May 4 '20 at 22:30
3

My WP site just got hacked for the third time even after following WP hardening guidelines

(Emphasis added).

I would suggest that you Nuke It From Orbit.

This would entail completely wiping the infected systems and reinstalling everything from scratch.

As the quote goes: "...It's the only way to be sure."

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.