perezbox

Ok, best of luck. Keep us posted.

Hi @velibor

Working with Google blacklists can be a bit tricky. We put together this guide to help in the process: https://sucuri.net/website-security/google-blacklisted-my-website

Google if flagging you because it’s seeing a redirect here:

Some pages on this website send visitors to the following dangerous websites: oxyo.home[.]pl.

We put together this guide to help you walk through the process of cleaning up your site: https://sucuri.net/guides/how-to-clean-hacked-wordpress

Hope this helps.

Hi @netvision

Yes, there are numerous very large sites running the plugin.

With that in mind, would you be open to sharing more information? Would love access to the logs, maybe the server so that we can see what might be going on?

Please let us know.

Tony

Hi @errol

Thanks for the feedback. Unfortunately my response is out of context with the original post being modified. Rest assured though, the original post offered no feedback, but rather was an attempt to smear our name by posting unrelated information.

I assure you, a good CEO will always defend his developers and the products they build, especially when it’s free. I do appreciate your candor, and hope you will do the same for mine.

Hi @elza

Not understanding how something works, doesn’t mean it doesn’t work. The site was hacked not because the plugin was activated, but because it was likely improperly maintained.

The Security Plugin Ecosystem: https://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-ecosystem.html

The plugin itself is not a preventive security tool, it’s a utility tool designed to help you harden and provide better visibility into what is happening. This is how we describe it in the notes.

Security is a complex domain, so much so I have written an article that will hopefully explain how so:

https://perezbox.com/2015/10/website-security-is-not-an-absolute/

I have a wide range of security related articles you might be interested here: https://perezbox.com/category/security/

So to your points:

The plugin does not provide security. period.

It does provide security, it’s just different than your interpretation of what “security” should be.

This week, with the plugin activated, a site was hacked.
Now how does that provide security?

It’s difficult to say without more context, but a few ways it would have contributed to your security posture:

1 – As you referenced in your various other posts, the tool was notifying you that someone was trying to repeatedly log into your environment. This is called a brute force attack, something I talk about here: https://blog.sucuri.net/2014/03/understanding-denial-of-service-and-brute-force-attacks-wordpress-joomla-drupal-vbulletin.html

2 – If the attacker abused a vulnerability in the code and modified core files, it wold have alerted to you that issue via integrity issues.

3 – If the attacker made changes to posts and pages and other configuration changes the tracking feature would have notified you.

4 – The tool would also have assisted you in the post-compromise process as well, via those features.

5 – The tool has a section specific for hardening. In fact, we keep the hardening simple and practical intentionally, because in our experience it’s they are the most effective.

So again, not understanding a domain or how a tool works, doesn’t mean something doesn’t work.

Thanks

Tony

Hi @elza

There is a fundamental difference between the FREE WordPress security plugin offered, and the services offered by Sucuri via our SaaS product offerings.

The SaaS product offering provides a website owner comprehensive security via our security stack, or protection only services specifically via our Firewall. Sucuri is not a plugin company, we are a security company that has developed and released a security plugin for the WP ecosystem.

The plugin doesn’t arbitrarily send emails, they’re sent when they’re triggered by an action. Just because you don’t want to see the emails, doesn’t mean you don’t have a problem.

The plugin provides you visibility into what is happening, that’s it’s purpose. If you prefer, don’t hesitate to use any other of the number of plugins out there. here is an article I wrote specifically talking to the myriad of options available to you: https://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-ecosystem.html

Your accusations however are unfounded. If you honestly feel the way you do, please remove it and move on, or disable the notifications. Also, just because an IP resolves to a host doesn’t mean the attack is not happening.

Thanks

Hi Ioscamos

With that many domains, managing their security can be challenging. Have you ever considered leveraging a security service provider like Sucuri? Especially if you’re continuously getting hacked, sounds like it might be time to get some professional help.

With an environment like this, there are multiple places to account for with issues. Here are two articles to assist:

https://blog.sucuri.net/2012/07/website-malware-removal-wordpress-tips-tricks.html

and

https://blog.sucuri.net/2012/11/website-malware-removal-ftp-tips-tricks.html

Hope these helps, let us know if you need more help.

Tony

Hi @obisike

Need a bit more information. What did the host say about why they disabled the account? Did they provide any list of issues?

Here are some tips that are still very applicable: https://blog.sucuri.net/2012/07/website-malware-removal-wordpress-tips-tricks.html

Hi @cedaly1968

If you’ve been having this issue for a year, I would probably stop avoiding the list of things you should do. If you don’t do the things you need to, you’re likely to continue to find yourself in the same situation over and over again. Also, it’s a bit detracting for anyone willing to help if you’re not willing to help yourself.

If the user continues to be generated you inevitably have a script or code snippet that’s doing the regeneration. Either in a script on the server, or inside a file (i’d look in your functions file). Also, using .htaccess to block access to login will do little for you if the user can initiate the regeneration via direct access or some automation script.

Best of luck