Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded.

Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed.

I had also modsecurity on my nginx- firewall on - maldet and rkhunter on my server wordfence on the wordpress site, still hacked. How can I prevent this ?

Im trying to recover it but Im not experienced so Have couple of questions:

  1. When WSO Shell is uploaded , does that mean the whole server is compromised or only the host which the site was on?

  2. What and where I should check for changes ? should I check the whole server or the host only ?

  3. How can I find the place or the bug that led to this hacking

  4. How to stop and find all the files that were changed by the user

  5. I suspended the account , is that enough to stop the malicious code and hacker untill I start the purge on the host or server ?

  6. How can I completely encapsulate a website so that once a hacker manages to inject some script, it won't help him accessing any other website or server

I am still investigation and will update the post.



Browse other questions tagged .