1

This had been added to our wordpress site, specifically in the footer.php.

hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js

It is malware as defined by google, i belive it is tracking code.

We have complex passwords and use https for /wp-admin. We do not however block access to /wp-admin using htaccess - but that would not have stopped this ?

How do they occur, how can I stop them ?

2
  • 3
    There are many potential ways to attack a Wordpress install (or any web app for that matter). For a start you should read codex.wordpress.org/Hardening_WordPress
    – Joel L
    Commented May 3, 2013 at 14:48
  • You're inquiring about causes yet you only provide post-injection information. It's impossible for us to give you a meaningful answer, considering information we have available. Go through your web server's and CMS's log files and look for any relevant or otherwise fishy entries just before this injection happened, then add that data to your question. You might want to inspect timestamp of the file or database record involved (where this injected JS is called from) and go up from that time in your logs. You'll be looking for curious looking GET request URIs and/or POST/PUT requests.
    – TildalWave
    Commented May 3, 2013 at 18:03

2 Answers 2

3

The difficulty with these sort of code injections is that if you are using a hosted service provider is it possible for the infections to spread between the various clients hosted. It may not be your actual installation of WordPress that is the problem.

Another thing you can ensure is that all of your plugins and your WP is up to date. Following the hardening procedures are another thing to help with that.

I also recommend installing the WP BulletProof Security plugin.

1

It can also be a FTP injection. Basically a PC with FTP access to the server that has passed the FTP details to a third party who then change the files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .