My site KEEPS getting hacked

[+Nik Louch Subscriber²]

I have my own shared webhosting provided through UKHost4u... I host a wordpress blog on there. It keeps getting hacked. I've changed all passwords, etc. Wiped the space clean, reinstalled over 3 times now.

The recent reinstall was a few days ago. I slapped a theme on but haven't had chance to post yet.

And BAM it's got another damned JavaScript injection.

I hosted previously under another provider and no such issues.

I have spoken to the hosts, and they say that it's basically not their issue.

Can someone help, gimme an idea whats going on? I'm at my witts end over this...

www.brandbeast.co.uk

[Barney T. Administrators]

I've used Sitelock in the past for protection. I have found it to really work wonders....... Another good one is We Watch Your Website.

[Guest]

Move to another host...

[Hum]

Can you block Java scripts ?

I blame Iran ...

[+Nik Louch Subscriber²]

Can I personally block scripts locally? I'm sure I can yes, but how will that help?

OK, it seems the threats are being uploaded into my themes folder...

[+Ryster Subscriber²]

Setup your domain to use cloudflare... it adds an extra layer of protection by blocking connections from know hackers, spammers, etc. It also provides a cache of your site when your actual host is down. Best of all it's free :)

Not saying it'll 100% solve your problems, but it can't hurt.

More info:

http://www.cloudflar...atures-security

[+Nik Louch Subscriber²]

Is it likely to be because Wordpress by default allows these folders to be accessed and written? As such, should I get my site setup and then just lock down the security?

[Noir Angel]

Move to a host with support for mod_rewrite, it allows scripts to write files to those directories without them needing to be chmodded at 777 for full public access. Your host's security practises sound pretty poor

[+Nik Louch Subscriber²]

In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :(

[Toysoldier]

Are you using shared hosting? all it takes is one site on the shared server with a SQL vun or another exploit and bam the server gets rooted, very common practice.

[Noir Angel]

In fairness, I don't fully know what I'm doing, they seems to offer a lot of things, but they just aren't being particularly helpful :(

If they had mod_rewrite it would be set up server side in PHP, it doesn't need to be configured independently by each customer :) I admit Linux isn't my strength but a good admin would be able to harden a Linux server against such exploits.

[cybertimber2008]

Yea it's probably that. What OS are you using and what services do you have running (SSH, FTP, etc)?

If you are running Linux, set up a seperate partition for /var/www , and set it in /etc/fstab to mount read-only by default. When you need to add something, you run "mount -o remount,rw /var/www" to make it writable, and then "mount -o remount,ro /var/www/" when you are done.

That and there should be a guide on what folders should have what permissions set. You should take care to make sure those are set.

[Nexx295]

Ask your host to install ModSecurity and/or Suhosin. ModSecurity is a web application layer firewall and Suhosin protects from insecure codes used by inexperienced PHP developers.

Another thing your host should do is to run PHP in suPHP or FastCGI mode so the hackers can't make use of insecure file and folder permissions.

It seems like you have some vulnerable plugins/themes, so ask your host to do a maldet scan for your account, provide you with a list of infected files and then search the access logs to see who the hacker is and how he was able to inject the infected files. You should also see in the logs the script that was exploited to inject the malware and then you'll know which plugin or theme you should remove.

If your host can't help you with this, then it's about time that you search for a more experienced and secure provider, preferably a CloudFlare partner so you can use CloudFlare to add an extra layer of security and speed up your website. If you need a recommendation which would fulfill the stuff mentioned above, I'd be glad to help.

[Yorak]

By chance, are you using a theme from a third party, or a paid one for free? Catch my drift?

If so, I guess they can be infected just like any other file that can be retrieved like that. If you are uploading the same theme each time and don't notice the problem until you upload it, then we probably have the answer. Just check the theme files out to see if they are infected. NOD32 gave me five separate warnings about your page. I'll have to check the logs to see what all it found.

[+Nik Louch Subscriber²]

I am using a purchased theme yes, all fully paid for, etc. But it's not when I upload he theme, it's usually after a week or so.

I think I will look at another host. Remember though, this is cheap shared hosting.

[Gaffney]

ukhost4u doesn't exactly look like the best host 22 out of 79 ratings on the google review of the site are 3 stars or under. I'm also doubting some of the reviews since 20 of them are duplicates and all of them are 3 or 4 stars. There is only one four star rating with a name attached and only 15 of the 40 5 star ratings have names attached.

I'm with stablehost(they have servers in Germany). They aren't the biggest but they have good ticket support, good server stats and the best thing about them for me is they are really reliable. I've only had to contact support twice since 10th July 2011 the last one being in January. One was my fault with importing a SQL table that went into a loop and they helped fix that problem, the other was one of their servers hardware started to crap out causing the site to go slow, they moved me to a new server. Really good prices as well so their name fits the bill.

I'm really skeptical after being on hostgator, sharkspace, dreamhost and two other small hosting sites. The big ones have dumb staff and their servers get problems often, the small ones usually have support issues since they usually only have a couple of people running it in their past time so when things go wrong it might take a few hours to get a ticket response. Stablehost is in the middle taking the best from both.

Not sure how stablehost deal with hack attempts though, my site's have been hacked before but not on stablehost. Could be they have tough defenses or no one has aimed at me in the last year or so.

If you fancy them click here

If not my advice is don't go with the big giants or one man shows.

[+Nik Louch Subscriber²]

I will certainly take that advice on board. Just a pain to move my domains...

[f0rk_b0mb]

MSE just popped up and said I had a virus when I went to that website. Move to another host---really....

[+Nik Louch Subscriber²]

Um, while I value the time u spent...

It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site?

[Ph1b3r0pt1c]

Um, while I value the time u spent...

It did not say you had a virus, it said it blocked a javascript injection. Why is it ok to blame the host and not my securing of my site?

Because nothing anyone says here is going to fix it. This is up to the site admins and not you.

[+Nik Louch Subscriber²]

Site admins? Have you followed the thread? It's MY site. Sure it's on their servers, they host it, but I uploaded Wordpress, set it up, installed the theme and didn't lock anything down beyond the standard install...