Title: WordPress site hacked Last modified: August 19, 2016 --- # WordPress site hacked * Resolved [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/) * My small wordpress site was hacked. I got a notice by email (see below) and I can’t log in by FTP. I have contacted the host. Is this a common occurrence? How do I prevent it? ——– Dear Team * It appears that your website [http://alwen.org/wp-includes/](http://alwen.org/wp-includes/) has been hacked by a fraudster. It is now hosting a phishing attack against ABSA Bank. Please remove the fraudulent folders/files as soon as possible and secure your website as it has been compromised. Please note that it is possible that the fraudulent content is embedded in your website’s legitimate files. * [http://alwen.org/wp-includes/tuks/internet-banking-update/login.do/onlinelogin.php](http://alwen.org/wp-includes/tuks/internet-banking-update/login.do/onlinelogin.php) * In addition, please send us any source files of the attack. Please let us know if you have any questions or need further assistance. We appreciate your cooperation. * Best Regards, * RSA Anti-Fraud Command Center RSA, The Security Division of EMC US Phone: +1- 866-408-7525 Viewing 15 replies - 1 through 15 (of 15 total) * [sjoep](https://wordpress.org/support/users/sjoep/) * (@sjoep) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413072) * Request your logins on your wordpress site else call your host and say that you want to delete your site ore reinstal it. * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413074) * Thanks! How do I prevent this in the future? * [Roy](https://wordpress.org/support/users/gangleri/) * (@gangleri) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413077) * First read this and all the links given: [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked) * When you’re 100% sure you’ve cleaned up properly: [http://codex.wordpress.org/Hardening_WordPress](http://codex.wordpress.org/Hardening_WordPress) * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413080) * Talked to the host. He got logged in by changing the password (FTP) and I’m now able to log in too. Neither of us can find the folder and document that is sited in the email warning. Is this a bonafide group that is sending the warning? When I key in part of the address they site I do get a “this is blocked” message. * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413082) * Thanks, Gangleri. Will do. * [Roy](https://wordpress.org/support/users/gangleri/) * (@gangleri) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413089) * Theoretically it could be possible that you weren’t hacked indeed. I see no indication of it at first site, but that fact that you weren’t able to login is a bad omen. What WP do you use anyway? Some modified version? The source hardly looks like a WP source. In any case, now that you’re able to login again, snoop around a bit for hack indications, such as extra users (look in the users table of the database, since they might be hidden), extra files or folders (does that internet banking mean anything to you?), etc. The first link in my previous reply may give some inspiration what to look for. The second link never hurts to put into practice. * [Roy](https://wordpress.org/support/users/gangleri/) * (@gangleri) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413091) * Hmmm, something fishy _is_ going on. Look at these: [http://www.phishtank.com/phish_detail.php?phish_id=937672](http://www.phishtank.com/phish_detail.php?phish_id=937672) [http://www.phishtank.com/phish_detail.php?phish_id=937536](http://www.phishtank.com/phish_detail.php?phish_id=937536) * These are the only hits besides this thread that Google gives, but it seems that someone tried to make a bogus login screen at your site, but was so stupid to use the wp-includes folder (which normally isn’t a viewable folder) instead of the root of your website. * I’d have a very good look at the files and folders. It doesn’t really seem to be a WP hack, but they _did_ land in a WP folder. * [edit] the fact that your wp-includes folder is viewable isn’t a good thing either. Please upload an empty index.html or index.php there asap to prevent people from browsing that directory. * That “tuks” folder isn’t there, that’s a good thing at least. Perhaps you’re facing a half-succeeded hack, or with less luck, the first part of a hack. * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413096) * Thanks for all that info! I will certainly protect the wp-includes folder with an index. * I got info from another source I respect that said the stuff below. I only have 2 plugins active: Akismet and Thesis OpenHook. Openhook is not an image upload program. However, I did try to go to the site for that plugin and developer and get an internal service error. Also tried his email address and got it returned. Anyone heard from Rick Beckman? Doubt it all has anything to do with that, but it is all odd. — Based on where the compromised files were, most likely you have an insecure plugin installed in that copy of wordpress (assuming wordpress was at a later 2.8.x version or 2.9.x which should be secure). It’s not likely they got into anything via the password, these types of attacks are always through either vulnerable core versions of wordpress, or more likely, the plugins. Once they find a plugin that allows them to upload their own file to the server, they make that file a php file they they can then access directly to run further commands from so just by getting that one file onto the server, they no longer need wordpress to help them, they can do whatever they want after that using their file. Obviously plugins that involve uploading are typically the culprit, such as image or video posting plugins where the user can upload their own file; typically its a lack of security by the plugin programmer who maybe doesn’t check enough to make sure the file that has been uploaded really is an image and not a php script or something else. * [Roy](https://wordpress.org/support/users/gangleri/) * (@gangleri) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413100) * I still doubt it’s a WP issue. You could have a fellow webmaster on the same server with crappy security or a problem at your host. But to do your side of the job, read the two articles I linked to. Check for those possible rotten files or users, clean up properly, make sure to run the latest version of WP and have a good study of the hardening article. Then it is to be hoped that your host also seriously looks at things to see if it is something on their side. * And now I’m off… so good luck. Be thorough. * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413103) * Thank you so much! * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413302) * This link (below) says to define a Secret Key. I’m not sure exactly where to put it in the wp-config.php. Any help would be appreciated. [http://ocaoimh.ie/did-your-wordpress-site-get-hacked/](http://ocaoimh.ie/did-your-wordpress-site-get-hacked/) * If you’ve been hacked * 1. Upgrade to the latest version of WordPress. 2. Make sure there are no backdoors or malicious code left on your system. This will be in the form of scripts left by the hacker, or modifications to existing files. Check your theme files too. 3. Change your passwords after upgrading and make sure the hacker didn’t create another user. 4. Edit your wp-config.php and change or create the SECRET_KEY definition. It should look like this, but do not use the same key or it won’t be very secret, will it? * define(‘SECRET_KEY’, ‘1234567890′ ); * [ineedahelp](https://wordpress.org/support/users/ineedahelp/) * (@ineedahelp) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413304) * Hi, * I’m such a newbie and shouldn’t be replying, but while researching my issues I noticed what you are looking for in the wp-config.php file. Good luck! * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413305) * Are you talking about this part: * define(‘AUTH_KEY’, ‘put your unique phrase here’); define(‘SECURE_AUTH_KEY’,‘ put your unique phrase here’); define(‘LOGGED_IN_KEY’, ‘put your unique phrase here’); define(‘NONCE_KEY’, ‘put your unique phrase here’); * I wondered about that. * [mrmist](https://wordpress.org/support/users/mrmist/) * (@mrmist) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413308) * Yes, you should change all the “put your unique phrase here” bits to some random text. * Thread Starter [vtolbert](https://wordpress.org/support/users/vtolbert/) * (@vtolbert) * [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413323) * Thanks! Viewing 15 replies - 1 through 15 (of 15 total) The topic ‘WordPress site hacked’ is closed to new replies. * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 15 replies * 5 participants * Last reply from: [vtolbert](https://wordpress.org/support/users/vtolbert/) * Last activity: [16 years, 5 months ago](https://wordpress.org/support/topic/wordpress-site-hacked-3/#post-1413323) * Status: resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics