3

I have a Wordpress site with some plug-ins installed. I would like to check if my site tries to access any 3rd party servers in the background.

I'm aware of that I can open any php file on my server and look for networking php commands. I wonder if there are any server-side security tools to monitor such activities automatically.

( My main concern is making sure that my website does not leak any data through some functions hidden in plug-ins and does not download malicious code. )

Improve this question
4
  • Are you looking for a recommendation or ideas? Recommendations are off-topic here, however, I want you to get an answer. Can you clarify just a bit so that your question does not get closed?? Cheers!!
    – closetnoc
    Feb 15, 2016 at 19:31
  • PHP and Apache (I'm making the assumption your WP site is on Apache) do not log outbound connections, so you have no practical way to do this. And if you don't trust the plug-ins, get rid of them! You shouldn't be running anything suspicious like that on your site - visitors are trusting you not to infect their machines and your reputation is at risk.
    – Tom Brossman
    Feb 15, 2016 at 20:47
  • Hello closenoc, Thanks for your comment. I'm not looking for recommendations of software products or something, rather I would like to know if there are any tools at all for this and I am also interested in best practice ideas from other webmasters. Cheers. :)
    – user14188
    Feb 15, 2016 at 20:48
  • Thank you, Tom. Actually I try to do my best about this.
    – user14188
    Feb 15, 2016 at 21:13

1 Answer 1

Reset to default
1

This is exactly why I hate wordpress and other CMS's. simply because so much can be added to it (including malicious scripts).

Now the easiest way is to check each PHP file as it applies to wordpress and look for anything unusual added to your scripts since the time the fresh installation happened. To start, download a fresh copy of wordpress, and store it in some hidden location on your server that no one can access. Then compare the file size of each PHP file in the original wordpress installation and in the current live wordpress folder. If the file size has changed, then check the contents of each file as one might be hacked.

Next, look for any PHP statements referring to opening a remote file such as file_get_contents and definitely look for any references to unwanted URLs and if they weren't in the original wordpress install, then reinstall the PHP files. Think of it like patching your computer.

According to https://stackoverflow.com/questions/6887338/wrapper-is-disabled-in-the-server-configuration-by-allow-url-include-0, there is a setting that is supposed to prevent some PHP functions from accessing a remote file while still allowing to access local files. I haven't tried it personally tho.

If you can't do that, then you could either write a script that reads the wordpress files at regular intervals and checks them for malicious content then have the script report such found content to you.

If that doesn't work for you, then you'll have to go deep inside the system (enter the shell) and somehow execute commands to attach to the running php and/or apache (or whatever your server is) processes and see what system commands are being run.

If you want to go crazy on this last idea, then this video is for you:

https://www.youtube.com/watch?v=eF-p--AH37E

Improve this answer
2
  • Thank you, Mike. :) Usually I install only a few essential WP plug-ins that are absolutely necessary for my sites. In fact, I even feel uncomfortable about installing the official FB plug-in that hasn't been updated for ages. So, as I can see now, it's a real security issue that most webmasters casually upload and install random plugins to their sites on shared hosts... while there is no easy way to check what those stuffs do in the background. :-/
    – user14188
    Feb 15, 2016 at 21:10
  • Man if only a company could understand what $#!% we webmasters go through to try to keep a website running without failure, I'd be hired in my field by now instead of a $#!%%y job. And you're welcome.
    – Mike -- No longer here
    Feb 15, 2016 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.