Recently an employee of mine developed a website in WordPress. Things were all fine until we received an email from Google , notifying me that some stuff that can really create security issues is going on in the WordPress site. On checking the FTP, I found an unusual folder there!! I could not delete it or modify it. The permission of the file was with the folder owner,changing which,most weirdly, I did not have permission! So I update WordPress thinking that it would solve the issue. Again, it was fixed for Sometime, but now I am receiving 1000 and more emails from an unknown account. The mail server of the site is over flooded and the client is on fire! I suspect this to be a DOS attack (Denial of service). How can I solve this? Any suggestion would make me indebted. Thank you in advance!!
1 Answer
Take your website down, fix the security problem (that folder didn't come there by accident it was most likely put there through another vulnerability). Check your code for vulnerabilities, anonymous write on your ftp server, places in your code where there is a risk for command injection, SQL injection, etc...
Next install a spamfilter and automatically delete emails coming from that user or blacklist the offending mailserver's IP address.