1

I have my wordpress installed in my purchased hosting company. I see from my security plugin that the attacker changes IP and installs malware such as WP-vcd, and changing the themes such as wordpress original themes and thus gain access. Now I want to re-install the wordpress again but this time I built it through localhost, is there anyway to achieve the installation without the attacker targeting the site? I will be adding more prevention work through .htaccess locking the IP and only allowing my IP to do the work.

But I wouldn't be able to prevent the attacker if during installation they still have their program up. I don't know what program they are using, but they have been targeting my domain, and keeps finding all the folders.

I hope this makes sense. I appreciate all the feedbacks and help.

7
  • 2
    If you're too concerned about the attacker getting access to your hosting space before you lock down it, you need to suspect that your account with the webhosting company is compromised or in the worst case, entire hosting server is compromised. In any of the cases you can ask them to give you a fresh account in a different server, but ask them not to update DNS records with new server's IP addresses. Once you have locked down your space on new server, you can ask them to update DNS records. Or consider another hosting provider. BTW, please do not reuse any database or files from old one
    – Nikhil_CV
    Jun 1, 2019 at 6:56
  • 1
    There is something amiss here. Just because someone is acanning/attacking you does not mean they should be able to subvert your site. - a fresh default wordpress install with a non-default password should be fairly secure - certainly for long enough to add additional security measures. It sounds like something else is compromised. If thats.not the case, set uo a .htaccess file restricting access to your IP before reinstalling wordpress and then opening it up when secure.
    – davidgo
    Jun 1, 2019 at 8:02
  • May I ask who your hosting provider is? Are you on "shared hosting" or do you use a "cloud" VPS?
    – dhaupin
    Jun 1, 2019 at 21:31
  • @dhaupin, I am using share hosting. Jun 2, 2019 at 21:08
  • @nikhil_cv, thanks for the info regarding DNS record and I will remember for now on not to use the same database. It seems to me [and i dont know too much of the cyberattack] that the attack uses brute force attack, and was able to install WP-vcd and access the xml file through the original theme of Wordpress. I have then since started using new theme and hopefully that can help the problem, and they even hacked in through the plugin. From studying WP-vcd the attack is able to create a new admin user name such as 11001010 something similar to that. -cont Jun 2, 2019 at 21:11

2 Answers 2

2

It would be a major failing if your hosting provider's server is compromized as suggested in the comments. If you seriously think that has occurred, I would change hosting companies and seek a refund of your hosting fees from your current provider.

If you don't feel that is the problem, not using admin as a username would help enormously for one thing. It is a standard username provided by WordPress and everyone knows it, so hackers will use that username to start with to attempt to work out what your login details are.

If you want to do the most you can to secure a WordPress site, you can't go far wrong in carrying out all the steps below:

  • Follow all the steps in https://www.codeinwp.com/blog/secure-your-wordpress-website/
  • As well as changing the database table prefix from wp_ to something different, another thing to do with your new setup, as @Nikhil_CV pointed out in the comments, is to not use the same password for your FTP server, database and WordPress administrator logins.
  • Use secure passwords which use a combination of upper-case letters, lower-case letters, numbers AND special characters (!£$%^&*@ and the like).
  • If you have other people set up as administrators, don't do that again until you have determined whether or not one of the others is to blame.

Be careful setting file restriction access within the .htaccess file.

Restricting access to only your IP before reinstalling WordPress, as suggested by @davidgo could be a good idea, but only if you have a static IP address. You could end up locking yourself out of your hosting server if you don't have a static IP address.

2
  • Thank you for the info I will try this. I had not previous lock the wp-config. The attack was using some program and scanned the plugins, themes, and i believe through either of them they were able to create a new account. I saw from Wordfence log that they were in a link that only admins can enter (when I use the page editor the link will change). So I have high suspection that the plugin and or the theme was the problem. And I just need to add on more security measure to it. But I don't know if these will be enough. Jun 2, 2019 at 21:15
  • I am planning on relocate / add restriction on Wp-config, change login admin, strong password, 2FA password, and i am looking into some more restrictions on the directory. Jun 2, 2019 at 21:16
2

There is no way an attacker could be doing this unless:

  • You or another account on the shared hosting server has some kind of shell installed
  • And/or attacker has an account on the same server, the host hasn't properly "jailed" accounts/processes (ie CloudLinux), and is SSH'ing to see your account name, files, runtime, etc
  • And/or the attacker has compromised (and you are using) server software auto-installer such as Softalicious or Plesk WP manager
  • And/or the attacker is originating from your physical network, device, or PC (ie RDP, SSH, backdoor, trojan, keylogger)
  • And/or the attacker has your high level login such as Gmail/Lastpass, and is able to see your saved logins/passwords
  • And/or you are using a vulnerable plugin that is allowing file/folder traversal/execution. Or you have vulnerable code in place(s) like functions.php (look in default themes too)
  • And/or you are using the same hosting password, FTP(s), WebDAV(s), WP login(s), password(s), path(s), or DB name/schema/credentials on the new install

To answer your question regarding localhost install: You can install at localhost, or using host domain (ie like, srv-12ayx.myhosting.com), or anywhere really, then easily migrate to live env. Create a blank WP DB first, import your new DB, and find+replace instances of the localhost/other domain string in DB (ie, settings table).

Then upload a zipped archive of the files of the new WP to wherever you want WP to live. Unzip, make sure config.php DB credentials match new DB, then login as usual. Using a zip is important because uploading all the WP files via something like FTP is slow.

Finally, installing a WAF plugin such as Wordfence can help automate the blocking of nefarious IP's, vulnerable routes, and directory traversal vectors. This plugin also provides whitelisting for your own safe IPs (assuming your PC isn't itself compromised).

I would not recommend static IP blocks/allows in .htaccess, as this is not an effective solution to the issue. It's simply a block, and if/when it's lifted, they will continue to attack the same vector that previously allowed them to exploit you. Additionally, .htaccess will only block IP's at the web root + subfolder level. There are like 20 other levels this attacker could be exploiting that .htaccess can't block.

2
  • I think what you say about vulnerability in function.php is correct, because I received the email from Wordfence it is the plugin and theme that have been compromised. I have since then changed to a new theme, and new paid plugin for page editing, and I will be removing most of the plugin once I finish building on localhost. What frustrates me was that it seemed that almost nothing that I did was able to prevent the attacker from seeing my new folders or new login page. Jun 2, 2019 at 21:19
  • Regarding your instruction of installing from localhost and migrate, the find+replace do you mean search in the myphpadmin? Jun 2, 2019 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.