Sign in to follow this  
Followers 0
Nik L (No longer active)

My site KEEPS getting hacked

21 posts in this topic

I have my own shared webhosting provided through UKHost4u... I host a wordpress blog on there. It keeps getting hacked. I've changed all passwords, etc. Wiped the space clean, reinstalled over 3 times now.

The recent reinstall was a few days ago. I slapped a theme on but haven't had chance to post yet.

And BAM it's got another damned JavaScript injection.

I hosted previously under another provider and no such issues.

I have spoken to the hosts, and they say that it's basically not their issue.

Can someone help, gimme an idea whats going on? I'm at my witts end over this...

www.brandbeast.co.uk

Share this post


Link to post
Share on other sites

I've used Sitelock in the past for protection. I have found it to really work wonders....... Another good one is We Watch Your Website.

Share this post


Link to post
Share on other sites

Move to another host...

Share this post


Link to post
Share on other sites

Can you block Java scripts ?

I blame Iran ...

1 person likes this

Share this post


Link to post
Share on other sites

Can I personally block scripts locally? I'm sure I can yes, but how will that help?

OK, it seems the threats are being uploaded into my themes folder...

Share this post


Link to post
Share on other sites

Setup your domain to use cloudflare... it adds an extra layer of protection by blocking connections from know hackers, spammers, etc. It also provides a cache of your site when your actual host is down. Best of all it's free :)

Not saying it'll 100% solve your problems, but it can't hurt.

More info:

http://www.cloudflar...atures-security

Share this post


Link to post
Share on other sites

Is it likely to be because Wordpress by default allows these folders to be accessed and written? As such, should I get my site setup and then just lock down the security?

Share this post


Link to post
Share on other sites

Move to a host with support for mod_rewrite, it allows scripts to write files to those directories without them needing to be chmodded at 777 for full public access. Your host's security practises sound pretty poor

Share this post


Link to post
Share on other sites

In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :(

Share this post


Link to post
Share on other sites

Are you using shared hosting? all it takes is one site on the shared server with a SQL vun or another exploit and bam the server gets rooted, very common practice.

Share this post


Link to post
Share on other sites

In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :(

If they had mod_rewrite it would be set up server side in PHP, it doesn't need to be configured independently by each customer :) I admit Linux isn't my strength but a good admin would be able to harden a Linux server against such exploits.

Share this post


Link to post
Share on other sites

Yea it's probably that. What OS are you using and what services do you have running (SSH, FTP, etc)?

If you are running Linux, set up a seperate partition for /var/www , and set it in /etc/fstab to mount read-only by default. When you need to add something, you run "mount -o remount,rw /var/www" to make it writable, and then "mount -o remount,ro /var/www/" when you are done.

That and there should be a guide on what folders should have what permissions set. You should take care to make sure those are set.

Share this post


Link to post
Share on other sites

Ask your host to install ModSecurity and/or Suhosin. ModSecurity is a web application layer firewall and Suhosin protects from insecure codes used by inexperienced PHP developers.

Another thing your host should do is to run PHP in suPHP or FastCGI mode so the hackers can't make use of insecure file and folder permissions.

It seems like you have some vulnerable plugins/themes, so ask your host to do a maldet scan for your account, provide you with a list of infected files and then search the access logs to see who the hacker is and how he was able to inject the infected files. You should also see in the logs the script that was exploited to inject the malware and then you'll know which plugin or theme you should remove.

If your host can't help you with this, then it's about time that you search for a more experienced and secure provider, preferably a CloudFlare partner so you can use CloudFlare to add an extra layer of security and speed up your website. If you need a recommendation which would fulfill the stuff mentioned above, I'd be glad to help.

Share this post


Link to post
Share on other sites

By chance, are you using a theme from a third party, or a paid one for free? Catch my drift?

If so, I guess they can be infected just like any other file that can be retrieved like that. If you are uploading the same theme each time and don't notice the problem until you upload it, then we probably have the answer. Just check the theme files out to see if they are infected. NOD32 gave me five separate warnings about your page. I'll have to check the logs to see what all it found.

Share this post


Link to post
Share on other sites

I am using a purchased theme yes, all fully paid for, etc. But it's not when I upload he theme, it's usually after a week or so.

I think I will look at another host. Remember though, this is cheap shared hosting.

Share this post


Link to post
Share on other sites

ukhost4u doesn't exactly look like the best host 22 out of 79 ratings on the google review of the site are 3 stars or under. I'm also doubting some of the reviews since 20 of them are duplicates and all of them are 3 or 4 stars. There is only one four star rating with a name attached and only 15 of the 40 5 star ratings have names attached.

I'm with stablehost(they have servers in Germany). They aren't the biggest but they have good ticket support, good server stats and the best thing about them for me is they are really reliable. I've only had to contact support twice since 10th July 2011 the last one being in January. One was my fault with importing a SQL table that went into a loop and they helped fix that problem, the other was one of their servers hardware started to crap out causing the site to go slow, they moved me to a new server. Really good prices as well so their name fits the bill.

I'm really skeptical after being on hostgator, sharkspace, dreamhost and two other small hosting sites. The big ones have dumb staff and their servers get problems often, the small ones usually have support issues since they usually only have a couple of people running it in their past time so when things go wrong it might take a few hours to get a ticket response. Stablehost is in the middle taking the best from both.

Not sure how stablehost deal with hack attempts though, my site's have been hacked before but not on stablehost. Could be they have tough defenses or no one has aimed at me in the last year or so.

If you fancy them click here

If not my advice is don't go with the big giants or one man shows.

Share this post


Link to post
Share on other sites

I will certainly take that advice on board. Just a pain to move my domains...

Share this post


Link to post
Share on other sites

MSE just popped up and said I had a virus when I went to that website. Move to another host---really....

post-447111-0-38645200-1350230124_thumb.

Share this post


Link to post
Share on other sites

Um, while I value the time u spent...

It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site?

Share this post


Link to post
Share on other sites

Um, while I value the time u spent...

It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site?

Because nothing anyone says here is going to fix it. This is up to the site admins and not you.

Share this post


Link to post
Share on other sites

Site admins? Have you followed the thread? It's MY site. Sure it's on their servers, they host it, but I uploaded Wordpress, set it up, installed the theme and didn't lock anything down beyond the standard install...

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.