Posted 6 years ago #
I just had a problem with a blog I installed. When you go to the Main Page is tell you that "It doesn't look like you've installed WP yet. Try running install.php." But when I run INSTALL.PHP is claimed that "Already Installed
You appear to have already installed WordPress. To reinstall please clear your old database tables first."
How do you protect the WP-CONFIG.PHP file from being downloaded and seen by other users and use your database Username and password to exploit your site?
Posted 6 years ago #
Check with your host first before you panic; this sort of thing can happen sometimes if they upgrade/change version of programs (php, mysql, apache) backend.
Posted 6 years ago #
Well apparently, someone has accessed the database and manipulated the tables.
To answer your original question, the wp-config.php should be chmodded to 644 at most.
Note that it IS php, so unless php completely dies, it displays nothing in a browser. NO password, NO login, NO nothing.
If you dont believe me, bring up the file in a browser window.
http://www.yourdomain.com/path/to/wp-config.php <--
If you want to be really anal, you can do this in an .htaccess:
<Files "wp-config.php">
Order Deny,Allow
Deny from all
</Files>
That will restrict it from being loaded in a browser window at all.
Example:
http://www.village-idiot.org/wp-config.php
Thats about all you can do to keep someone that does NOT have shell access from reading it.
---
If you reallllly wanted to be anal you could load it outside of your web path .. ie .. move it out /public_html (or your equiv), change all the paths, etc..
Posted 6 years ago #
You might consider posting detailed information about what actually happened.
Posted 6 years ago #
here are details about the error.
- accessed the blog through the main url, and the message is shown: "It doesn't look like you've installed WP yet. Try running install.php"
- Clicking install.php then gives this message: "Already Installed
You appear to have already installed WordPress. To reinstall please clear your old database tables first."
- checked the PHPAdmin database, and it only 4 (whereas the normal should be 10) tables were present, and Errors such as "cannot find wp_options.MYI"
I've resolved this by removing the whole database and creating a new one. I could not restore the original entries because the actual owner did not have a backup. (I was only asked to see what's wrong with it)
Now for that fix that restricts access to the wp-config.php... will that prevent the file from being downloaded using a website downloader? (you can grab a freeware on snapfiles.com that can download websites, depending on its security setup).
Posted 6 years ago #
Hmmm. I think I remember reading hereabouts (you could try a search for it) that the "wp_options.MYI" sort of errors are something to do with needing to repair the database, generally something you get the host to do.
Posted 6 years ago #
If wp_options.MYI is missing (which can happen for lots of reasons, few of them nefarious), then it would definitely affect the ability to open the remainder of your tables.
Normally the best option here is to contact your host and report the error. If you're lucky they can repair it by retrieving the file from backup.
Now for that fix that restricts access to the wp-config.php... will that prevent the file from being downloaded using a website downloader? (you can grab a freeware on snapfiles.com that can download websites, depending on its security setup)
yes.
and I have to say that nothing youve described thus far indicates your database was tampered with. But thats neither here nor there.
Posted 6 years ago #
Thanks everyone, that was quite a good help.
This topic has been closed to new replies.
