I have a WP site that was hacked, I have an old copy that I used and the site hacked again on another server, I suspect this copy have a trojan horse in it which created new folder for phishing. What to do in order the wp/site will be "frozen", no new content no new PHP files, no PHP file mods, SAME SAME all?

  • 2
    If the document root where your website exists is already breached, then locking it down won't make any difference as they're already in and can access what they like. You need to rid of the vulnerability first. This of course, does depend on the extent and nature of the hack/attack.
    – zigojacko
    May 5, 2015 at 12:44
  • Forgot to say that I am talking about cpanel.How do I get read from rid of the vulnerability, virus scanner found nothing.
    – ofir
    May 5, 2015 at 12:56
  • 1
    Perhaps start by modifying your question to explain what the symptoms are of the hack. How do you know it was hacked, what is happening, describe the problem etc?
    – zigojacko
    May 5, 2015 at 13:46
  • We get questions about hacked WP sites all the time. Make sure that your WP site is up to date and secure including plug-ins and themes before trying to clean up. Then run an anti-virus product against your hard-drive including rootkit. Some WP sites are attacked repeatedly external to WP using a virus regardless of how secure the WP site is. Then you clean-up your site.
    – closetnoc
    May 5, 2015 at 15:59
  • Also, check server logs to see what has been hammering your server. Look for entries adjacent to each other where the time the entry was recorded is within 10 seconds of each other from the same IP or similar IP's. I'm guessing some robot from china cracked your wp-admin password. Also, after you setup wordpress, make sure any links pointing to the admin interface are disabled. May 6, 2015 at 21:49

2 Answers 2


If what you say above about "no new content" is correct, then instead of attempting to harden WordPress, you could remove it completely after generating completely static output.

You can use a spidering program like HTTrack or a plugin like Simply Static to accomplish it. Removing WordPress will absolutely remove the ability to hack WordPress and if the site is not going to change very much or very often then this is a great security step.


Whether this will work or not really depends on the method used to hack your site. If the attackers where able to gain remote access to your server then there is no real way to prevent later changes to files after they have been uploaded. If the attack vector is through WordPress itself then you can restrict the file permissions for WordPress to the minimum required permissions which may help.

The minimum permissions needed by WordPress are as follows...

/ - Root WordPress Directory:
All files should be writing by your user account only except for .htaccess if you want WordPress to automatically generate the rewrite rules for you.

/wp-admin/ - WordPress Admin Directory:
All files should be writable by your user account only.

/wp-includes/ - WordPres Application Logic
All files should be writable by your user account only.

/wp-content/ - User Supplied Content
The directory and all files contained therein should be writable by your user account and the web server process.

Within /wp-content/...

/wp-content/themes/ - Theme Files
If you want to use the in-built theme editor then files need to be editable by the web server process otherwise only your user account needs write access.

/wp-content/plugins/ - Plugin Files
All files should be writable by your user account only.

Other directories that may be present in /wp-content/ should be documented by whichever plugin or theme requires them. Permissions will vary.

(Sourced From https://wordpress.org/support/article/hardening-wordpress/)

If the problem is that the attackers gained remote access to the server itself you will need to scan the server for malware and viruses to make sure there aren't any on the server. Once this has been done you should apply firewall restrictions limiting remote access from the internet only to port 80 (HTTP) and port 443 (HTTPS). If you need remote access through SSH or a web admin panel (such as cPanel, Plesk, Webmin, etc) then you should open up the firewall to allow remote access on those ports only, but if possible restrict access to those ports to your IP address only. If this sort of attack has occured it could also pay to look into hardening Apache and hardening your Linux server. Instructions how to do both those things are beyond the scope of this question but you can take a look at http://www.tecmint.com/apache-security-tips/ and http://www.cyberciti.biz/tips/linux-security.html for some good pointers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.