1

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: enter image description here

How can i protect my site from this attack? Help, please! Thank in advance!

2
  • that classic config.php~ backup trick :p it's a source code disclosure vulnerability, remove each and every backup file which corresponds to the file.
    – v1k45
    Commented Sep 6, 2014 at 14:32
  • Based on the sheer number of "backups" that were found, I suspect it's a false positive.
    – Mark
    Commented Oct 6, 2014 at 21:06

1 Answer 1

1

Remove wp-config.txt, wp-config.php.original, etc. (but not wp-config.php!)

If those files don't exist, then it's a bug in the scanner. If the file contains passwords (like a database password), change them immediately.

How your Wordpress got hacked and how those files were created is anyone's guess. Each installed Wordpress plugin can be vulnerable, as can Wordpress itself. Or you may have a weak password for ftp, the Wordpress admin panel, or something else. Even your hosting may be hacked.

Make sure your Wordpress installation and all plugins are up to date, and don't install untrusted plugins (like ones that have few or no reviews).

2
  • Thank friends! I can't find anything like that in my site. Another problem is the bandwidth is always over 1000GB a week and die all night.
    – Jane Brye
    Commented Aug 21, 2014 at 15:20
  • @JaneBrye in that case I think someone might be abusing your hosting account for spam or DDoS attacks or something. Without more details I can't really say anything, but one way to stop it is change hosting and do a fresh Wordpress install. Or have someone look at it.. perhaps the hosting company can look through logs? It's in their interest not to end up on blacklists.
    – Luc
    Commented Aug 21, 2014 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .