Wordpress targeted by attacker, how to install in that situation?

Question

I have my wordpress installed in my purchased hosting company. I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress original themes and thus gain access. Now I want to re-install the wordpress again but this time I built it through localhost, is there anyway to achieve the installation without the attacker targeting the site? I will be adding more prevention work through .htaccess locking the IP and only allowing my IP to do the work.

But I wouldn't be able to prevent the attacker if during installation they still have their program up. I don't know what program they are using, but they have been targeting my domain, and keeps finding all the folders.

I hope this makes sense. I appreciate all the feedbacks and help.

Answer 1

It would be a major failing if your hosting provider's server is compromized as suggested in the comments. If you seriously think that has occurred, I would change hosting companies and seek a refund of your hosting fees from your current provider.

If you don't feel that is the problem, not using admin as a username would help enormously for one thing. It is a standard username provided by WordPress and everyone knows it, so hackers will use that username to start with to attempt to work out what your login details are.

If you want to do the most you can to secure a WordPress site, you can't go far wrong in carrying out all the steps below:

• Follow all the steps in https://www.codeinwp.com/blog/secure-your-wordpress-website/
• As well as changing the database table prefix from wp_ to something different, another thing to do with your new setup, as @Nikhil_CV pointed out in the comments, is to not use the same password for your FTP server, database and WordPress administrator logins.
• Use secure passwords which use a combination of upper-case letters, lower-case letters, numbers AND special characters (!£$%^&*@ and the like).
• If you have other people set up as administrators, don't do that again until you have determined whether or not one of the others is to blame.

Be careful setting file restriction access within the .htaccess file.

Restricting access to only your IP before reinstalling WordPress, as suggested by @davidgo could be a good idea, but only if you have a static IP address. You could end up locking yourself out of your hosting server if you don't have a static IP address.

Answer 2

There is no way an attacker could be doing this unless:

• You or another account on the shared hosting server has some kind of shell installed
• And/or attacker has an account on the same server, the host hasn't properly "jailed" accounts/processes (ie CloudLinux), and is SSH'ing to see your account name, files, runtime, etc
• And/or the attacker has compromised (and you are using) server software auto-installer such as Softalicious or Plesk WP manager
• And/or the attacker is originating from your physical network, device, or PC (ie RDP, SSH, backdoor, trojan, keylogger)
• And/or the attacker has your high level login such as Gmail/Lastpass, and is able to see your saved logins/passwords
• And/or you are using a vulnerable plugin that is allowing file/folder traversal/execution. Or you have vulnerable code in place(s) like functions.php (look in default themes too)
• And/or you are using the same hosting password, FTP(s), WebDAV(s), WP login(s), password(s), path(s), or DB name/schema/credentials on the new install

To answer your question regarding localhost install: You can install at localhost, or using host domain (ie like, srv-12ayx.myhosting.com), or anywhere really, then easily migrate to live env. Create a blank WP DB first, import your new DB, and find+replace instances of the localhost/other domain string in DB (ie, settings table).

Then upload a zipped archive of the files of the new WP to wherever you want WP to live. Unzip, make sure config.php DB credentials match new DB, then login as usual. Using a zip is important because uploading all the WP files via something like FTP is slow.

Finally, installing a WAF plugin such as Wordfence can help automate the blocking of nefarious IP's, vulnerable routes, and directory traversal vectors. This plugin also provides whitelisting for your own safe IPs (assuming your PC isn't itself compromised).

I would not recommend static IP blocks/allows in .htaccess, as this is not an effective solution to the issue. It's simply a block, and if/when it's lifted, they will continue to attack the same vector that previously allowed them to exploit you. Additionally, .htaccess will only block IP's at the web root + subfolder level. There are like 20 other levels this attacker could be exploiting that .htaccess can't block.