BulletProof Pro?

One of our test sites has been getting hammered pretty hard the last few days with Brute Force Login attempts so we decided to just block the wp-login.php page entirely by adding the wp-login.php filename to this security filter in the root .htaccess file.

Note: this site is just for testing and is seldom used so no one is currently logging into it. In order to be able to login to this test site it requires that you FTP to the site and remove wp-login.php from this security filter.

<FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php|wp-login\.php)">
Order allow,deny
Deny from all
</FilesMatch>

The 3 primary targets in the highest order/number of attacks are:
1. FTP password cracking.
2. WordPress Brute Force password cracking.
3. Cross site infection/attacks.

What this means is that your site was most likely (98% likelihood) hacked using one of the 3 primary attack targets/methods and the malicious code was injected/added after your website was hacked using one of the 3 primary targets/methods.

The most desireable hack for a hacker is to crack your FTP password since this gives them full control of your entire hosting account. If you have a guessable FTP username it is only a matter of time until your FTP account is hacked. There are several free FTP password cracking apps available on the Internet.

FTP account usernames should never be displayed publicly or shared with anyone else. You should never save/store FTP passwords in your Browser or FTP connection apps and you should ALWAYS type in your password each time you make an FTP connection.

Example Secure FTP account info:
Username: e5t8by3we2p9r8j
Password: r#@478!y35Jb4#X@h!

Yes, Cross site infection/attacks mean that another website hosted on your same Server is either a victim site used to attack your site on the same Server or it is a hacker’s site and the attack is completely intentional on all other sites on that Server.

Typically hackers prefer to use victim sites since they cannot be traced back to the hacker. So if they can compromise/hack a site on a server then the next step is to try and hack as many other sites on that same server. The objective is always volume with minimal effort. ie hack as many sites as possible with the least amount of effort.

99% of all hacking is automated with hacker bots. A human hacker typically only visits the website after is has already been hacked or may never visit the hacked site.

The fact that you stated this – “In my case all the infected sites are hosted on a single (shared) server.” – indicates that one of the 3 primary hacking methods was used since multiple sites are hacked and not just a single website.

BPS does provide a fair amount of protection against cross site infection. BPS Pro has the ARQ IDPS, which is the final security layer if all other security layers have not stopped the hacking method/attack. In the case of an FTP password being cracked, this is outside the control/protection capabilities of any WordPress plugin (ie a plugin cannot directly protect FTP accounts). ARQ IDPS is classified as countermeasure security since an attack/hack is still prevented/stopped even though the hacker has cracked your FTP password or performed a cross site attack/hack.