Hackers – what else can I do?

Well… I think I did all the things in that guide. Only the htaccess things seem new to my untrained eye…

And god, please stop telling me to remain calm. After a week of constant artillery fire, that’s not quite having the effect you’re hoping for 😉

ok… I am really confused.
I had to restore the files to the state they were in before I changed the prefix to my tables. My host helpdesk tells me the prefix is in the wp-config, but there it still lists the old prefix…

how can this be? Shouldn’t this cause a conflict? I mean, the file tells to look to table prefix A, but this doesn’t exist anymore.

I’ve changed it into the prefix which it should have, and the site seems to work (also after purging the cloudflare cache).

So…. what else did I do?

Well, i did change the .htaccess yesterday, putting this in (source):

WP-Content/Uploads

The uploads directory is the one directory that will almost need to be writable by the web server. It’s where all files are uploaded remotely. You want to prevent PHP execution in this directory, you can do this by placing an .htaccess at the root of /UPLOADS using:

# Kill PHP Execution
<Files *.php>
deny from all
</Files>

Note: This can break your theme if it requires PHP execution in UPLOADS. If you apply it and the site breaks, remove it and the site will reappear.
WP-Config.php

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it:

<files wp-config.php>
order allow,deny
deny from all
</files>

Disable File Editing

It is recommended to disable file editing within the WordPress dashboard. WordPress has a constant that disabled this editing via the wp-config.php file. Append the following two lines to the end of your wp-config file:

## Disable Editing in Dashboard
define(‘DISALLOW_FILE_EDIT’, true);

I copy pasted both into my htaccess, directly following the standard bits. Can this be cause for problems?

• This reply was modified 9 years ago by Jeroenla. Reason: extra info

dafuq…now the site is gone again…
I get the setup page!

And the saga continues. Every day, my index.php gets some script injected, along with wp-settings and…uh… another one.

I’ve changed the rights for wp-settings to 400, and index as well.

I’ve changed password to the admin user
I’ve changed ftp password
I’ve changed cPanel password
I’ve changed them again

I’ve moved wp-admin (using iThemes security)
I’ve changed the prefix

I’ve run a AVG scan on my desktop
I’ve run a Malwarebytes scan on my desktop
I’ve run an S&D Spybot scan on my desktop

I’ve sacrificed three virgins at a stake of burning oakwood at full moon…..

I’ve gone through my files, and removed a bunch of old (legacy) stuff, including my old Joomla installation.

Anything else?

(PS: No, I cannot hire a pro. I just don’t have that kind of money and this is just a hobby. Please, don’t suggest it, and don’t tell me I should chose wisely. If there is no money, there is nothing to chose.)

…vector…? Does that mean “something which could cause the problem”?

I am indeed on 4.7.2. I’ve spoken to the host. Nothing that can be done. Also noteworthy… I have other WP sites with them. Not all are affected.

I have also gone to change my .htaccess as described here: https://codex.wordpress.org/Hardening_WordPress

And for most of the suggestions, I understand what they do, but what does this mean:

WP-Config.php

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it:

<files wp-config.php>
order allow,deny
deny from all
</files>

(Cross my fingers that the site still works once I upload the changed htaccess….

• This reply was modified 9 years ago by Jeroenla.

Edit: changing the htaccess killed the site. I put the following behind the content which was already in it:

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
# BEGIN WordPress

# Kill PHP Execution
<Files *.php>
deny from all
</Files>

## Disable Editing in Dashboard
define('DISALLOW_FILE_EDIT', true);