Posted 3 years ago #
My website got hacked (http://benjamincharity.com) by '4rcD3ViLL3'. But I've checked my htaccess files and searched my database for several phrases and such and looked through several of my template files. The only thing out of place was the admin login was changed so I reset the login and password.
But my site is still messed up! It doesn't redirect or anything but displays content that's not mine. I'm over my head here, any direction for me???
Thanks in advance
Benjamin
Posted 3 years ago #
Alright. Since you've put up a filler image I can't see anything for your site. Just because your site was hacked by 4rcD3ViLL3 doesn't mean that he'll put his name where he screwed things up.
I would definitely try index.php or home.php and try replace those with an older backup.
Posted 3 years ago #
Try the plug-in called exploit scanner. It will scan your database and your files. It will look for suspicious iframes and scripts - it identifies those bits of code and shows you where they are - you have to remove the code yourself. Also you can just look in your theme files for iframes that look out of place and remove them.
Posted 3 years ago #
Thanks for everyones input! I still never found the exact code or even which file contained it. But my hosting provider replaced my files with a backup from the day before and it remedied it.
Airlias: The filler image was replaced by the hacker's content but was back up when I fixed it.
fldtrace: Those were my first choices too! I also tried my header.php, functions.php, footer.php, wp-config.php and my htaccess but didn't see anything out of the ordinary.
PBP_Editor: That sounds very useful!! I tried searching through my files manually for scripts and iframes and a few other key phrases that I was told to look for but couldn't find a thing. That plugin would have saved me some time for sure!
I have since taken some steps to (hopefully) make it harder for someone to hack my site:
1. I have chosen a much better password (letters+numbers+uppercase+lowercase)
2. I am using the 'Chap Secure Login' plugin
3. I am using the 'Login Lockdown' plugin
4. I have removed the WordPress version meta tag
5. I have hidden my plugins folder by adding a blank index.php inside
6. All plugins and wordpress is current
7. I renamed the administration account
If there are any other ways to make it more secure, I'd love to know them!
Posted 3 years ago #
Always look inside your WordPress error logs to see which files were compromised recently. The code or link farm is usually hidden inside files you would never think to look in. Scan your entire PC for trojans/malware. The hacker gains access to your WordPress files through your FTP on your desktop. Do not log into your FTP until you find and remove the trojan from your PC. You will keep getting hacked until you find the trojan on your PC.
This topic has been closed to new replies.
