Hacked

  • Resolved handiguy

    (@handiguy)


    1 week, 4 days ago

    hi, my fully updated WordPress installation was hacked. I’m on Hostinger. I thought i’d give a brief description here in case anyone wants to know more.

    i posted a link to a data privacy tool 2 days ago on mastodon. I noticed a minute or two later that my site was brought down: ‘cannot connect to db” error. The db had been remotely accessed and corrupted.

    i had a strong password but had whitelisted remote db access for some reason. I entered my hostinger control panel and asked ai to repair the db. Apparently it could not, and it restored my last 24 hr backup. I lost a little work. No big deal.

    i changed the db pass in wp-config and removed remote access. This restored my system. Obviously i could not trust the files.

    I then noticed i was locked out and my wp credentials were not working. So, i logged in using the hostinger control panel. Then i changed all the credentials in wp-config and installed a 2FA plugin. This held and the site was backup.

    i didn’t have an smtp plugin functioing so i was kinda locked out of the system because the 2FA couldn’t email me. No biggie.

    the site was back up. I was on my touchscreen, i left it for a few hours until i was back on my system.

    in the end i installed a static website plugin on localhost then i deployed this staic site to production. I now use wordpress locally for editing etc. But i push a static website to live.

    the hack appeared to have originated in the US. I’ll examine the logs closely. Does anyone have any specific questions beforehand?

Viewing 4 replies - 1 through 4 (of 4 total)
  • Moderator threadi

    (@threadi)

    1 week, 4 days ago

    I’m not quite sure what your question is exactly. It strikes me that you immediately assumed the “cannot connect to db” message meant the site had been hacked. The message simply says that the database was unreachable. This could primarily be a problem with the database’s availability on the hosting server, in which case your hosting provider’s support team should be able to help.

    However, I also notice that you mention Mastodon in this context. Do you use ActivityPub to publish posts there? It’s well known that new posts in this setup can sometimes generate a very high volume of requests from the Fediverse, which – depending on the project and hosting – may lead to increased server load. These requests can come from all over the world. In this context, using static pages, as you’ve set them up, can definitely help. If you have any questions about this, I’d recommend reaching out to the ActivityPub support forum: https://wordpress.org/support/plugin/activitypub/ – but this has nothing to do with a hack.

    In summary, based on your description, I don’t see where a hack might have occurred in your case. However, if you aren’t using ActivityPub, I’d want to take a closer look at exactly what you did on Mastodon.

    Thread Starter handiguy

    (@handiguy)

    1 week, 4 days ago

    thanks. No. I didnt use ActivityPub to post. It was a hack…

    This post was just meant as a heads-up!

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    1 week, 4 days ago

    What ever you do, don’t post data from the hack, code, etc. here. None of that actually matters, what matters is finding the source of the exploit, closing it an delousing your site.

    FAQ My site was hacked

    https://jetpack.com/resources/what-to-do-if-your-wordpress-site-is-hacked/

    Oichin

    (@oichin)

    1 week, 3 days ago

    It sounds like you went through a classic “trial by fire” security incident, but you ultimately ended up with a very solid architecture! Moving to a local WordPress setup and deploying a static site to production (often called headless or jamstack WordPress) is actually one of the most secure ways to run WordPress. Because there’s no active database or PHP execution on your public server, you’ve essentially eliminated the vast majority of web attack vectors.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.