1

I was alerted by my web hosting and a scanning service I pay for that my website had malware (php.spam-seo.injector). My main website is a Joomla 3.6.4 (latest) site. All of the plug-ins are up to date. I have changed the passwords and I use a hidden redirect of the administrator side.

While the alerts are doing what they are supposed to, how do I track down where this came from to prevent it from happening again?

As added info there are several "add-on" websites on our hosting account that are WordPress sites. Some of these sites are outdated versions, but they are maintained by someone else. Can the malware be getting back to our main Joomla site through these? I would think they would only have write access to their home directories and not the root directory of our main site.

Improve this question
4
  • 2
    What do you mean by "add-on" websites exactly? If it's anything like cPanel's add-on domains then they aren't "sandboxed" into their own home directory - they have access to the entire account (as does the "someone else" who maintains that site). So, it would be quite possible for a hacked WordPress site on one of these "add-on domains" to affect the entire account.
    – MrWhite
    Nov 28 '16 at 19:32
  • As added info there are several "add-on" websites on our hosting account that are WordPress sites. Some of these sites are outdated versions, but... There's your problem! ;-) As a web host years ago, I checked each site automatically daily for up to date software and enforced updating the sites so that systems are not compromised. You really need to police this. For your own sake if for no other reason. Cheers!!
    – closetnoc
    Nov 29 '16 at 1:52
  • Yes, cPanel add-on domains. It wasn't clear to me until now if they were sandboxed into their own home directory. Thanks!
    – Roberto
    Nov 29 '16 at 12:22
  • 1
    Related question: With PHP how to restrict access from one Addon domain to another?
    – MrWhite
    Dec 2 '16 at 0:05
1

Ideally, websites should be hosted on their own shared web hosting account.

When one website is compromised in a shared web hosting account, then the others will also likely become compromised.

Websites sharing the same web hosting account all need to be maintained to keep the websites secure.

Once one website is compromised, you should scan the whole account to find and fix vulnerabilities.

Update Joomla, WordPress and all third party extensions / add-ons to the latest versions on all websites on a regular basis to keep all websites secure.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.