Title: mathieg2's Replies | WordPress.org --- # mathieg2 [ ](https://wordpress.org/support/users/mathieg2/) * [Profile](https://wordpress.org/support/users/mathieg2/) * [Topics Started](https://wordpress.org/support/users/mathieg2/topics/) * [Replies Created](https://wordpress.org/support/users/mathieg2/replies/) * [Reviews Written](https://wordpress.org/support/users/mathieg2/reviews/) * [Topics Replied To](https://wordpress.org/support/users/mathieg2/replied-to/) * [Engagements](https://wordpress.org/support/users/mathieg2/engagements/) * [Favorites](https://wordpress.org/support/users/mathieg2/favorites/) Search replies: ## Forum Replies Created Viewing 8 replies - 1 through 8 (of 8 total) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Understanding email delivery](https://wordpress.org/support/topic/understanding-email-delivery-2/) * [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 8 months ago](https://wordpress.org/support/topic/understanding-email-delivery-2/#post-13832440) * Depending on your email provider, you might be able to find the emails in your sent items folder if you log into your account directly. * Graeme * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/page/2/#post-13786432) * If the hacker has got into your control panel, they may have made changes to the data in WordPress database. So if you have a database backup that you can go back to, it would be safer to revert that too. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13754412) * Hi Alexander, * I’d still recommend including this in the plugin’s zip, as every time I update your plugin, this file is being deleted. Also if someone else’s plugin goes rogue and exposes the directory listing, this .htaccess file would give some level of protection. * I’m not worried about myself – I make mistakes sometimes and know how to fix them. I’m more worried about your other users that might hit this issue and not know what to do about it. I don’t know if its possible to include .htaccess files in a plugin so please tell me if I’m getting it wrong so I can read up on how to do this in the apache configuration files. * .htaccess: * Require all denied - This reply was modified 5 years, 9 months ago by [mathieg2](https://wordpress.org/support/users/mathieg2/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13754331) * EHLO mydomain.co.uk CLIENT -> SERVER: AUTH LOGIN CLIENT -> SERVER: [credentials hidden]CLIENT -> SERVER: [credentials hidden]CLIENT -> SERVER: MAIL FROM: * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13754313) * Ok – now that the index.html files are in place. I will explain the hack. * There is one additional file I’d like you to deploy in plugin directory: * .htaccess: * Require all denied * What the hacker was doing was finding all the users who have your plugin installed via some sort of search engine – or perhaps just all the users who have wordpress. * They were then navigating to your plugin directory and getting a list of the files in that directory – one of which was the debug file. * Somehow they worked out the username of one of the admin accounts on the site and performed a password reset on that account through the user interface. * They then downloaded the debug file and used the link from that the password reset email to reset the admin password on the site. * Luckily I have 2FA on my account so the user was prevented from logging in – even with the reset password – but it could have been much worse – and for a few users, I would imagine they have a bit of a clean up operation ahead of them. * Graeme * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13752357) * This is what they are getting from my site now: * [Mon Dec 07 00:37:24.677270 2020] [autoindex:error] [pid 2138265] [client 212.227.174.234: 61985] AH01276: Cannot serve directory /var/www/xxxxxx/wp-content/plugins/easy- wp-smtp/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php, index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive, referer: [http://www.google.com](http://www.google.com) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13752350) * I just checked my logs: 212.227.174.234 is also the same ip address that is accessing my site. * It look like you have the same issue as me with your server config as the user got a 200 return code: * 212.227.174.234 – – [06/Dec/2020:06:55:42 -0800] “GET /wp-content/plugins/easy- wp-smtp/ HTTP/1.1” 200 4531 “google.com” “Mozlila/5.0 (Linux; Android 7.0; SM- G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/ 60.0.3112.107 Moblie Safari/537.36” * if you update the .htaccess in the root of your site to add a line: * Options -Indexes * then that will stop them from getting a directory of the plugin folder – which tells them the exact name of the debug file unfortunately. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more] Security Issue with debug log](https://wordpress.org/support/topic/security-issue-with-debug-log/) * Thread Starter [mathieg2](https://wordpress.org/support/users/mathieg2/) * (@mathieg2) * [5 years, 9 months ago](https://wordpress.org/support/topic/security-issue-with-debug-log/#post-13752307) * I found an additional issue on my server – it was missing Option -Indexes. Now fixed. But once the user knew the URL of the debug log they could download it directly. i.e. [https://mysite.com/wp-content/plugins/easy…/debugAGHHfT.txt](https://mysite.com/wp-content/plugins/easy…/debugAGHHfT.txt) * The exact url is different but you get the picture. * Graeme Viewing 8 replies - 1 through 8 (of 8 total)