Dick Montage Posted October 13, 2012 Share Posted October 13, 2012 I have my own shared webhosting provided through UKHost4u... I host a wordpress blog on there. It keeps getting hacked. I've changed all passwords, etc. Wiped the space clean, reinstalled over 3 times now. The recent reinstall was a few days ago. I slapped a theme on but haven't had chance to post yet. And BAM it's got another damned JavaScript injection. I hosted previously under another provider and no such issues. I have spoken to the hosts, and they say that it's basically not their issue. Can someone help, gimme an idea whats going on? I'm at my witts end over this... www.brandbeast.co.uk Link to comment Share on other sites More sharing options...
Barney T. Administrators Posted October 13, 2012 Administrators Share Posted October 13, 2012 I've used Sitelock in the past for protection. I have found it to really work wonders....... Another good one is We Watch Your Website. Link to comment Share on other sites More sharing options...
Guest Posted October 13, 2012 Share Posted October 13, 2012 Move to another host... Link to comment Share on other sites More sharing options...
Hum Posted October 13, 2012 Share Posted October 13, 2012 Can you block Java scripts ? I blame Iran ... Davo 1 Share Link to comment Share on other sites More sharing options...
Dick Montage Posted October 13, 2012 Author Share Posted October 13, 2012 Can I personally block scripts locally? I'm sure I can yes, but how will that help? OK, it seems the threats are being uploaded into my themes folder... Link to comment Share on other sites More sharing options...
Ryster Posted October 13, 2012 Share Posted October 13, 2012 Setup your domain to use cloudflare... it adds an extra layer of protection by blocking connections from know hackers, spammers, etc. It also provides a cache of your site when your actual host is down. Best of all it's free :) Not saying it'll 100% solve your problems, but it can't hurt. More info: http://www.cloudflar...atures-security Link to comment Share on other sites More sharing options...
Dick Montage Posted October 13, 2012 Author Share Posted October 13, 2012 Is it likely to be because Wordpress by default allows these folders to be accessed and written? As such, should I get my site setup and then just lock down the security? Link to comment Share on other sites More sharing options...
Noir Angel Posted October 13, 2012 Share Posted October 13, 2012 Move to a host with support for mod_rewrite, it allows scripts to write files to those directories without them needing to be chmodded at 777 for full public access. Your host's security practises sound pretty poor Link to comment Share on other sites More sharing options...
Dick Montage Posted October 13, 2012 Author Share Posted October 13, 2012 In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :( Link to comment Share on other sites More sharing options...
Toysoldier Posted October 13, 2012 Share Posted October 13, 2012 Are you using shared hosting? all it takes is one site on the shared server with a SQL vun or another exploit and bam the server gets rooted, very common practice. Link to comment Share on other sites More sharing options...
Noir Angel Posted October 13, 2012 Share Posted October 13, 2012 In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :( If they had mod_rewrite it would be set up server side in PHP, it doesn't need to be configured independently by each customer :) I admit Linux isn't my strength but a good admin would be able to harden a Linux server against such exploits. Link to comment Share on other sites More sharing options...
cybertimber2008 Posted October 13, 2012 Share Posted October 13, 2012 Yea it's probably that. What OS are you using and what services do you have running (SSH, FTP, etc)? If you are running Linux, set up a seperate partition for /var/www , and set it in /etc/fstab to mount read-only by default. When you need to add something, you run "mount -o remount,rw /var/www" to make it writable, and then "mount -o remount,ro /var/www/" when you are done. That and there should be a guide on what folders should have what permissions set. You should take care to make sure those are set. Link to comment Share on other sites More sharing options...
Nexx295 Posted October 13, 2012 Share Posted October 13, 2012 Ask your host to install ModSecurity and/or Suhosin. ModSecurity is a web application layer firewall and Suhosin protects from insecure codes used by inexperienced PHP developers. Another thing your host should do is to run PHP in suPHP or FastCGI mode so the hackers can't make use of insecure file and folder permissions. It seems like you have some vulnerable plugins/themes, so ask your host to do a maldet scan for your account, provide you with a list of infected files and then search the access logs to see who the hacker is and how he was able to inject the infected files. You should also see in the logs the script that was exploited to inject the malware and then you'll know which plugin or theme you should remove. If your host can't help you with this, then it's about time that you search for a more experienced and secure provider, preferably a CloudFlare partner so you can use CloudFlare to add an extra layer of security and speed up your website. If you need a recommendation which would fulfill the stuff mentioned above, I'd be glad to help. Link to comment Share on other sites More sharing options...
Yorak Posted October 13, 2012 Share Posted October 13, 2012 By chance, are you using a theme from a third party, or a paid one for free? Catch my drift? If so, I guess they can be infected just like any other file that can be retrieved like that. If you are uploading the same theme each time and don't notice the problem until you upload it, then we probably have the answer. Just check the theme files out to see if they are infected. NOD32 gave me five separate warnings about your page. I'll have to check the logs to see what all it found. Link to comment Share on other sites More sharing options...
Dick Montage Posted October 13, 2012 Author Share Posted October 13, 2012 I am using a purchased theme yes, all fully paid for, etc. But it's not when I upload he theme, it's usually after a week or so. I think I will look at another host. Remember though, this is cheap shared hosting. Link to comment Share on other sites More sharing options...
Gaffney Posted October 13, 2012 Share Posted October 13, 2012 ukhost4u doesn't exactly look like the best host 22 out of 79 ratings on the google review of the site are 3 stars or under. I'm also doubting some of the reviews since 20 of them are duplicates and all of them are 3 or 4 stars. There is only one four star rating with a name attached and only 15 of the 40 5 star ratings have names attached. I'm with stablehost(they have servers in Germany). They aren't the biggest but they have good ticket support, good server stats and the best thing about them for me is they are really reliable. I've only had to contact support twice since 10th July 2011 the last one being in January. One was my fault with importing a SQL table that went into a loop and they helped fix that problem, the other was one of their servers hardware started to crap out causing the site to go slow, they moved me to a new server. Really good prices as well so their name fits the bill. I'm really skeptical after being on hostgator, sharkspace, dreamhost and two other small hosting sites. The big ones have dumb staff and their servers get problems often, the small ones usually have support issues since they usually only have a couple of people running it in their past time so when things go wrong it might take a few hours to get a ticket response. Stablehost is in the middle taking the best from both. Not sure how stablehost deal with hack attempts though, my site's have been hacked before but not on stablehost. Could be they have tough defenses or no one has aimed at me in the last year or so. If you fancy them click here If not my advice is don't go with the big giants or one man shows. Link to comment Share on other sites More sharing options...
Dick Montage Posted October 14, 2012 Author Share Posted October 14, 2012 I will certainly take that advice on board. Just a pain to move my domains... Link to comment Share on other sites More sharing options...
f0rk_b0mb Posted October 14, 2012 Share Posted October 14, 2012 MSE just popped up and said I had a virus when I went to that website. Move to another host---really.... Link to comment Share on other sites More sharing options...
Dick Montage Posted October 14, 2012 Author Share Posted October 14, 2012 Um, while I value the time u spent... It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site? Link to comment Share on other sites More sharing options...
Ph1b3r0pt1c Posted October 14, 2012 Share Posted October 14, 2012 Um, while I value the time u spent... It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site? Because nothing anyone says here is going to fix it. This is up to the site admins and not you. Link to comment Share on other sites More sharing options...
Dick Montage Posted October 14, 2012 Author Share Posted October 14, 2012 Site admins? Have you followed the thread? It's MY site. Sure it's on their servers, they host it, but I uploaded Wordpress, set it up, installed the theme and didn't lock anything down beyond the standard install... Link to comment Share on other sites More sharing options...
Recommended Posts