I have a Wordpress website from a client that was hacked (website is clean now). The Wordpress is version 3.3.1 and it has 42 active plugins. It's a nightmare in that installation, after many tries updating the Wordpress core, plugins and fixing parts of code it still breaks the website.

From what I've seen I have two options:

  1. remake the entire website from scratch
  2. place it on a read-only folder on the server and restrict every write to it.

The client wants to keep the actual site in its current form so I need option 2

My question is what steps should I make to protect the outdated Wordpress and plugins on the server site? (I have access to the server CentOS7 that has installed and enabled selinux, mod_security and firewall-cmd)

  • 2
    Sometimes you just need to walk away. – Lucas Kauffman May 12 '15 at 10:37
  • Are all these plugins needed? From a security point of view, any one of them could house vulnerabilities. – S.L. Barth - Reinstate Monica May 12 '15 at 10:47
  • All are required. I know some of them are vulnerable even the wordpress core being an older version. All I want is to "freeze" the site so no modifications can be made to the files and what practices are good. – calculataur May 12 '15 at 10:51
  • 2
    If redoing isn't possible, then I guess the best you can do is "freeze" the app's files, put it in a VM you consider untrusted and can restore at any time, and firewall off all outgoing network access to prevent damage to other hosts if it still gets exploited. – user42178 May 12 '15 at 11:01
  • 1
    Also if that's possible, put the DB in read-only to prevent them from easily persisting data/malicious code, and put the DB server inside the VM (for something lightweight you may try SQLite if WP supports it), and make sure you monitor the VM. Unusual patterns like high memory/CPU/disk usage can mean something fishy is going on - a firewalled off VM isn't totally worthless for attackers, it can be used as an OCR for spambots, rudimentary cryptocurrency miner or hash bruteforcer. – user42178 May 12 '15 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.