How does WordPress site get hacked?
A WordPress site can get hacked due to number of reasons.
Outdated Version Many website owners do not update their WordPress version at all. Whenver an exploit/vulnerability is found and WordPress releases a new version you should always update it.
Insecure plugins Third party plugins like timthumb plugin can allow a website to get hacked because of vulnerabilities in the plugin itself.
Unsafe themes Don’t install any themes without verification of it’s security.
Weak passwords many website owners use very weak administrator and FTP passwords that can be guessed easily and hence leads to compromise.
Stolen FTP credentials trojans and nasty viruses that are present on PCs and computers used to upload material to a WordPress can sniff out the login credentials used by website admins and pass them off to automated bots that can infect websites.
What to do?
Scan your local machine
Sometimes the malware was introduced through a compromised desktop system. Make sure you run a full anti-virus/malware scan on your local machine. Some viruses are good at detecting AV software and hiding from them. So maybe try a different one. This advice generally only applies to Windows systems.
Another way is unhide all the files and folders and unhide the extensions of all the files, run a search for *.exe files, sort them by size, most malicious code is executable and is lesser than 5MB usually but can be > 5MB. Also not every .exe under 5MB is malicious, delete the known viruses/worms/autoruns, make a list of all suspected executables, check against online database.
Caution: Make sure you don’t delete the system files.
Check with your hosting provider
The hack may have affected more than just your site, especially if you are using shared hosting. It is worth checking with your hosting provider in case they are taking steps or need to. Your hosting provider might also be able to confirm if a hack is an actual hack or a loss of service, for example.
Change your passwords
Change passwords for the blog users, your FTP and MySQL users.
Change your secret keys
If they stole your password and are logged in to your blog, even if you change your password they will remain logged in. How? because their cookies are still valid. To disable them, you have to create a new set of secret keys. Visit the WordPress key generator https://api.wordpress.org/secret-key/1.1/salt/ to obtain a new random set of keys, then overwrite the values in your wp-config.php file http://codex.wordpress.org/Editing_wp-config.php#Security_Keys with the new ones.
Take a backup of what you have left
If your files and database are still there, consider backing (http://codex.wordpress.org/WordPress_Backups) them up so that you can investigate them later at leisure, or restore to them if your cleaning attempt fails. Be sure to label them as the hacked site backup, though…
Check your .htaccess file for hacks
Hackers can use your .htaccess to redirect to malicious sites from your URL. Look in the base folder for your site, not just your blog’s folder. Hackers will try to hide their code at the bottom of the file, so scroll down. They may also change the permissions of the .htaccess file to stop newbies from editing the file. Change the permissions back to 644.
Consider deleting everything
A sure way to remove hacks that currently exist, is to delete all the files from your web space, and clear out your WordPress database. Of course, if you do this, you would need backups to restore from, so …
Consider restoring a backup
If you restore from a known clean backup of your WordPress Database, and re-upload your backed up WordPress plugin and theme files through FTP or SFTP, that will ensure that all those bits are clean of malicious code are gone. At the very least …
Replace the core WordPress files with ones from a freshly downloaded zip
Replacing all your core files will ensure that they are no longer left in a hacked state. If you didn’t already restore backup copies of your plugin and theme files, replace them too.
Upgrade!
Once you are clean, you should upgrade your WordPress installation to the latest software. Older versions are more prone to hacks than newer versions.
Change the passwords again!
Remember, you need to change the passwords for your site after making sure your site is clean. So if you only changed them when you discovered the hack, change them again now.
Secure your site
Now that you have successfully recovered your site, secure it by implementing some (if not all) of the recommended security measures – http://codex.wordpress.org/Hardening_WordPress
Do a post-mortem
Once your site is secured, check your site logs to see if you can discover how the hack took place. Open source tools like OSSEC(http://www.ossec.net/) can analyze your logs and point to where/how the attack happened.
Keep regular backups
Now that the nightmare is over, start keeping regular backups of your database and files. If this ever happens again, all you will need to do is restore from the last know clean backup and change your passwords and secret keys.
Server Management Plus can do a full malware scan on your server, delete malware files and secure the server . Check our our server management plans for details
