my host is startlogic. com - they say the problem is with my site (wordpress). they have the hacker safe certification certificate displayed. see quote below.
i somehow believe the problem is with the plugins. thinking back to the time my site was hacked, i had re-activated safeincludes but i also had made a backup (using the backup plugin) and forgot to change the cmod of the backup directory which requires public or group access to write the backup. so i guess the hacker could have got in that way. i have since changed the cmod to that directory and have had no problems since.
i guess the problem is not with wordpress it's self but with the way i have been using the plugins - i.e the security has been slack on the access given to some of the files and directories used by these plugins. so i guess i will be more careful from now on.
here's the quote from the startlogic site's hacker safe certificate...
HACKER SAFE CERTIFICATION 05-MAR-2007
This site is tested and certified daily to pass the HACKER SAFE Security Scan. To help address concerns about hacker access to confidential data, the "live" HACKER SAFE mark appears only when a web site meets the HACKER SAFE standard.
Research indicates sites remotely scanned for known vulnerabilities on a daily basis, such as those earning HACKER SAFE certification, can prevent over 99% of hacker crime.