0

The hack redirects all my sites to another site

All are running WP 5.4.1 (latest) and I even have a site that barely runs any plugins, just a simple open-source theme with 3 common plugins - Contact Form 7, etc.

Thus, can I assume the attacker might be coming from A2 Hosting?

I moved one of my sites to a new host (InMotion Hosting) and left 2 running in A2 Hosting. I deleted another site. So, far both sites left in A2 hosting got hacked again (4th time). I did change cPanel password after 3rd hack. The InMotion site is safe. I did not delete any of my files or changed them. I just restored from old backup that I did at A2.

  • 1
    No, you can't assume that. – MechMK1 May 4 at 20:10
  • Why not @MechMK1 – cilapo1541 May 4 at 20:56
  • I mean coming from hoster can be from the cPanel too. – cilapo1541 May 4 at 20:56
  • Simply put, just because you can't imagine any other way doesn't mean there isn't another way. I don't know how you configured your system, but saying you're 100% certain it's secure and it must have been the hosting company is a very large stretch. – MechMK1 May 5 at 7:23
  • This sounds like an extension of your other question. Why post a new question? And please do not include the obviously sketchy URL in the question. We will get ranked for it and get confused people and bring attention to the obviously sketchy site. – schroeder May 5 at 20:09
1

As you said, it is possible that the server is vulnerable, so if your hosting plan is on shared hosting then it's the hosting provider's fault, and your websites are alright. However it's not easy to be sure about that. Here's a list of things I would consider:

  • Type of hosting. Is it shared hosting? Then you only need to make sure your home directory is clean, change every password (WP, cPanel, FTP, etc.), and check every setting in the hosting panel (like suspicious additional FTP accounts, etc.). But what if your hosting is an unmanaged VPS? Then it'd be a problem, you'd have to check everything, because you run the whole server (and you'd better nuke it from orbit).
  • Check every file. Supposing you are on shared hosting and you only need to check your home directory, you need to make sure every file is clean. Restoring from a backup might not be enough, because... are you really sure the backup is clean? One way to check if WP is clean is to download its original files (same version as yours), and compare them with your installation (with diff -rq for example). You can do the same for themes and plugins.
  • Check the database. This is hard. I don't know of a decent way to do this yet. There are probably some scanners available, specific for WP. Otherwise you need to check at least there aren't suspicious users with privileges in the user table. Then try to check if there is any JavaScript injected in posts, comments, etc. Something like grep -i 'script' might help, but it might not be enough and it might have too many false positives. As I said, I believe checking the DB is hard.
  • Contact the hosting provider. If you are pretty sure your website is ok, then the infection might come from a vulnerability on the server, which is run by the hosting provider.
| improve this answer | |
  • Faster than checking every file might be installing them fresly i.e. installing a clean copy of WordPress with the same themes and plugins and then just add the old database from a backup. – Esa Jokinen May 7 at 9:24
  • @EsaJokinen yeah, that might be a good idea, however in some cases there might still be differences. A clean installation won't have the image files, some changes to the config file, a child theme with your customizations, etc. Using diff you can see all the differences and decide to keep them if they are expected, or investigate further if they are suspicious. – reed May 7 at 9:36
0

No, your hosting provider didn't hacked you.

Your provider makes money, it's not a philantropic organization. And they make money hosting sites for people like you. They are not a hacking criminal gang, as far as I know.

If they hacked your site, you and all their clients would move away, and they would not make any money. And if they wanted to promote that site, they could buy a great quantity of domains, and advertise that site. Hacking its customers is counterproductive, illegal, and cumbersome.

What did happened is that your Wordpress installation is vulnerable: default passwords, old versions running, things like that. Some bot found it, and hacked it. And if all 3 Wordpress sites were installed the same way, they all have the same vulnerability.

| improve this answer | |
  • I didn't mean they hacked me. I meant someone came in via the server that I'm hosted with - either cpanel, server, etc. And all sites are installed VERY differently each with different themes and plugins. – cilapo1541 May 6 at 20:07
  • Are all the sites run as the same user? Then, one site compromised = all sites compromised. – Esa Jokinen May 7 at 9:31
0

It is difficult to give you a clear answer without auditing your websites, including the themes, the extensions and the database.

Even if you updated your themes and extensions to the last version, there is a possibility that a hacker managed to inject a backdoor in the past.

I would recommend you to scan your website in order to detect malware and viruses (using Sucuri or Malcare).

Perhaps, you could also copy/paste on Google the JavaScript that is used to redirect your visitors to another website. You might find other webmasters with the same issue.

| improve this answer | |
  • Free Sucuri and Malcare plugins said my sites are clean. – cilapo1541 May 7 at 6:39
  • copy and paste JS code is a good idea. Thx – cilapo1541 May 7 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.