you havent provided enough information for anyone to tell you where to look.
HOW were you hacked, WHAT was done?
never mind, I see it.
standard answer:
look through your database to make sure there arent unknown users with admin on your install.
Look through your pages, look at the source.
Look through the files as they exist on your web space – paying attention to timestamps.
Look at your raw server logs.
UPGRADE. can I say I probably told you so.
Thanks whooami for responding so quickly… I just realized that this particular site isn’t 2.3, so I will start there…
I did go into the db via phpMyAdmin and remove the name and url data that got added but of course, I know that isn’t the real source of the issue – just the result of being hacked. At least the sucker doesn’t get his/her name on my site for free.
do you think I should start with upgrading first?
TIA
if its the site I looked at its 2.3.1 😛
unless you have a second one thats been hit as well.
—
I left out some stuff, assuming they were able to write to a file, they were able to read files. Thats a safe assumption so change your db password.
the order you go in is up to you. 2.3.2 is, arguably, as insecure as 2.3.1. I say arguably, because its being argued that 2.3.2 installs are seeing trouble as well. The fact is though, without upgrading, one can never know if that solves whatever problems are there. (if that makes sense)
hmmm… I seemed to have fixed it? And did see that this IS 2.3.1, so I will upgrade manually since the hosting company isn’t using the latest version.
I don’t know what I did to let them in – like I said, I try to not have loose permissions or extraneous files or themes on the remote server.
Is there a single “how-to” documentation page where specific permissions settings are listed for what is required by WordPress files?
I did have to change the permissions for .htaccess to use permalinks, but have changed that back to more rigid controls afterward. I’ve not just removed files I feel are not in use (generally) except for something like “uploads” (since I do all my uploading outside of WP) and I am not really blogging or using any commenting. No one is allowed to register, even…
More soon. Thanks for being willing to even read and respond 🙂
directories: 755
files: 644
check your “about this site” page.
Thank you, I will… I’ve changed the password to something a lot more stringent and I don’t use the “admin” default as a username…
I also spoke with my web hosting company about how using the example.com/wp-admin/upgrade.php path to upgrade says I don’t need to upgrade… though my admin pages keep saying I do (and of course, I do, since the latest version is 2.3.2, not 2.3.1) They are looking into that for me as I did tell them that the latest version includes security fixes.
I *do* so appreciate your help! I will get back to you if I see anything or have more questions.
Thanks, whooami… I didn’t see that one. I’ve fixed it and will check through everything else.
What would these forums do without you? Thanks for the hours you must spend helping!
