워드프레스 사이트가 해킹되어 이상한 해킹 증상을 보입니까?
우리는 해킹을 정확하게 찾아 제거하는 것이 어려울 수 있다는 점을 이해하고 있으므로 즉시 해킹을 감지하고 제거하는 데 도움이 될 이 광범위한 가이드를 마련했습니다. 이 가이드는 WordPress 해킹의 증상, 감지 및 제거 프로세스를 다룹니다. 이 가이드에서는 가능한 해킹 원인과 유형도 다룹니다. WordPress 해킹 제거 단계로 바로 이동하려면 여기를 클릭하세요.
해킹된 WordPress 웹사이트의 증상
사이트 손상과 같은 것은 WordPress 해킹의 명백한 징후이지만 다른 징후는 미묘할 수 있습니다. 일반 사용자에게는 눈에 띄지 않을 수 있지만 여전히 많은 피해를 입히므로 발견하는 즉시 제거하는 것이 좋습니다. WordPress 해킹의 미묘한 징후는 다음과 같습니다.
1. 경고 메시지 수신
- 해킹된 WordPress 사이트가 있는 대부분의 사용자는 호스팅 제공업체로부터 계정 정지에 관한 경고 메시지를 받습니다. 이러한 메시지가 표시되면 사이트가 해킹된 것일 수 있습니다!
- 빠른 Google 검색은 웹사이트 이름 아래에 무서운 Google 경고 중 하나를 표시합니다.
- 트래픽의 급격한 감소 또한 WordPress 사이트에서 귀하의 웹사이트가 해킹 증상, 스팸 또는 악성 스크립트 등을 표시하기 위해 Google 및 기타 검색 엔진에 의해 블랙리스트에 추가되었을 수 있음을 나타냅니다.
- Astra Security 고객인 경우 웹사이트를 검색하는 동안 발견된 일부 악성 코드에 대한 경고 이메일을 받을 수 있습니다.
2. 사이트가 이상하게 작동하기 시작함
아래에 표시된 징후가 보이면 웹사이트가 WordPress 해킹의 피해자일 가능성이 매우 높습니다.
- WordPress 사이트가 사용자를 리디렉션하는 경우 이것은 해킹의 명백한 신호입니다. 당신은 buyittraffic 리디렉션 해킹, digestcolect 리디렉션 해킹, 아웃룩 리디렉션 등과 같은 리디렉션 WordPress 해킹의 피해자일 수 있습니다. 일반적인 악성 도메인은 - buyittraffic[.com], cuttraffic[.com], digestcolect[.]com, travelinskydream[.]ga 등입니다.
- 로그인할 수 없는 경우 해커가 설정을 변경하고 귀하를 축출했을 수 있습니다.
- Adblocker가 차단하고 있습니다. 암호화폐 채굴을 위한 WordPress 사이트
- 알 수 없는 팝업 및 악성 광고 WordPress 사이트에 나타나기 시작합니다.
- 음란한 푸시 알림 웹사이트에 나타나기 시작합니다. 예를 보려면 이 문서를 참조하십시오.
- 의심스러운 크론 작업 발견 서버에서 실행되기를 기다리거나 서버 로그에 의심스러운 활동이 표시됨 .
- 일부 일본어 문자 또는 의미 없는 콘텐츠가 나타남 워드프레스 사이트에서. 이것은 일본어 키워드 해킹 또는 Pharma Hack 등을 가리킵니다.
- 발신 WordPress에서 확산되는 스팸 이메일을 찾습니다. 웹사이트의 도메인입니다.
- WordPress 웹사이트에 예기치 않은 오류 메시지가 표시되고 사이트가 느려지거나 응답하지 않습니다 .
- 사이트에 트래픽이 많지 않지만 서버가 항상 많은 처리 리소스를 소모하고 있다는 것을 알게 되었습니다.
3. 파일의 변경 사항이 표시됩니다.
파일 변경은 웹 사이트가 WordPress 해킹에 의해 공격을 받았는지 알 수 있는 가장 쉬운 방법입니다. 다음은 찾아야 할 몇 가지 증상입니다.
- wp-admin에 알 수 없는 새 파일이 표시됩니다. 및 wp-포함 디렉토리. 이 두 디렉토리에는 거의 새 파일이 추가되지 않습니다.
- WordPress 테마, 머리글, 바닥글 파일이 리디렉션을 생성하도록 수정되었습니다.
- 신규 및 알 수 없는 관리자 WordPress 웹사이트의 데이터베이스가 표시되기 시작합니다.
- 검색 결과에 잘못된 메타 설명이 표시됨 귀하의 WordPress 사이트.
- 핵심 파일에서 악성 링크를 찾습니다. 스팸 링크 삽입은 WordPress 웹사이트에서 가장 흔한 공격 중 하나입니다.
- 외계인 .php 파일 추가 . 또는 이름이 눈에 띄지 않게 약간 변경된 인기 있는 플러그인의 복제 파일입니다. 최근의 '수익 창출' 해킹이 이러한 증상의 완벽한 예입니다.
WordPress 해킹을 수정하는 방법
실제로 WordPress 해킹에 직면하고 있다고 확신한 후 해킹 제거를 수행하는 방법은 다음과 같습니다.
1. 웹사이트 백업
웹 사이트의 전체 백업을 수행하십시오. 항상 하나를 보유하는 것이 좋습니다. Since the purpose of a backup is to restore the website in case of a mishap, do ensure that it is functional.
Make sure that your backup includes your WP core files, WP database, plugin files, theme files, and the .htaccess file . Most hosting services offer backing-up features. Get in touch with your hosting provider to learn the backup process. You can also take a backup manually via an SFTP client like Filezilla.
Site Backup
A few other ways to take a backup of your site are given below:
1. Use a Plugin
WordPress also has loads of backup plugins such as UpdraftPlus that simplify the process. You can take a full back up of your site with files &database.
- Install and activate the plugin.
- Backup your website and store locally or on the cloud.
2. Backup Via SSH
To take a backup of your files, here is what you can do,
- Access your website via SSH.
- And run the command –
zip -r backup-pre-cleanup.zip
This will make a zip file of your website which you can then download on your PC.
3. Backup Via SFTP
- Access your website through SFTP client like FileZilla.
- Just make a backup folder on your PC and copy the contents there.
Since this requires manual effort, it may take more time than the previous methods.
Database Backup
To take a complete backup of your database, you can do the following:
1. Backup via a Plugin
Again, you can use the same UpdraftPlus plugin to backup your database.
2. Backup via PHPMyAdmin
You can also export your database and store it in your PC via PHPMyAdmin.
- Access your WordPress database by PhpMyAdmin.
- Export the complete database easily. Store this in the same folder as above or make a different one according to your preference.
3. Backup via SSH
- Access your website through SSH.
- And run the following command:
mysqldump -p -h hostname -u username database > backup-pre-cleanup.sql
Do remember to change the credentials (username, passwords, hostname, etc.) before backing up the database. Also, remember to delete the copy from the file server after you’ve stored it locally.
2. Turn on the Maintenance Mode
If you have detected malicious activity on your website, it is only prudent to put it in maintenance mode. This will ensure that your visitors are not affected by the hack.
Also, while attempting to clean the hack, the changes might hinder the performance of your live site unless you’ve turned on the maintenance mode.
You can also use a WordPress plugin like the Coming Soon plugin to show quirky maintenance mode messages to your site’s visitors without revealing that you’re cleaning up a WordPress hack.
Here is how this plugin works:
- Install and activate the plugin. It will reflect as “SeedProd ” (developer’s name) in the left-hand panel of your admin panel.
- Enable the maintenance mode.
You can even customize the coming soon page with your brand’s message &logo with this plugin.
3. Change any current passwords
If you can still access your website, change all the passwords immediately to help cut off the hacker’s access. This should include passwords to your admin panel, hosting account, database, and other accounts. If you have other team members using the admin panel, ask them to change their passwords as well to avoid your site getting compromised.
You can also opt for a re-authentication of all user accounts. This will automatically log out every user from your website, and they will need to get authorized again. This is another way of seizing access from any unauthorized user.
It might be a good idea to create automatic new passwords with the help of a password management tool such as LastPass or KeePass for each of these accounts.
Note:When you change your database credentials, don’t miss adding that to the wp-config.php file.
4. Check for any Plugin Vulnerabilities
Vulnerabilities in third-party plugins are another common reason for WordPress hacks. As many as 56% of WordPress hacks are a result of plugin vulnerabilities.
So, before jumping to the cleaning process, make sure that the current versions of your plugins are vulnerability-free. To confirm this, you can check the WordPress forum or our blog. We try our best to keep our readers updated and safe by pushing out a blog or an advisory in case of a massive plugin exploit.
Since plugin exploits target large chunks of sites running the vulnerable plugin, you’ll find many people asking for solutions on forums. You can Google any particular vulnerability and find detailed steps on how to mitigate the vulnerabilities.
5. Diagnose Files
5.1. Use a malware scanner to find malicious codes
Run your site through a malware scanner (Astra has a great one!). It will fetch you details of all files with malicious content. You can also scan for malware manually, but that would require a lot of time.
If you find suspicious files, you can use online tools to decrypt their contents. Below is an example of a malicious file, hiddencode.txt. This can also be done using phpMyAdmin as shown in the image given below. That’s not all, phpMyAdmin can also come in handy while cleaning the database in case of a WordPress hack.
In case you find something suspicious but are unable to figure out what it does, you can get in touch with our experts. We’ll be happy to help!
5.2. Use the ‘find’ command to review recent modifications
In order to see any WordPress files modified by the attackers, obtain SSH access to your server and run the following command:
find . -mtime -2 -ls
This command would list all the WordPress files modified in the last 2 days. You can keep increasing the number of days till you find something fishy. Combine this find command of SSH with the grep command to search for code encoded in base64 format . Simply execute the following command:
find . -name "*.php" -exec grep "base64"'{}'; -print &> hiddencode.txt
5.3. Compare with the original WordPress files
You can also download fresh WordPress files from the WordPress directory and compare your backup with this. You can also use online tools like diff checker to find the differences between the files. Make sure to download files according to your WordPress version. Note the differences for further analysis. If you find any malicious injected links, remove them at once. It’s also a good idea to check the files for certain keywords like – eval, exec, strrev, assert, base64, str_rot13, Stripslashes, preg_replace (with /e/), move_uploaded_file, etc.
You can further simplify the search for these keywords by using commands. For instance, to search files with the keyword ‘base64’, run the following command:
sudo grep -ril base64 /
Now, replace ‘base64’ with each keyword to fetch files containing them and then review them attentively.
5.4. Check with Diagnostic Tools
Generally, webmaster’s tools are quick &accurate in detecting the hack. You can use these to find the problem. The Google search console, for example, lists the problems under the ‘Security’ tab. This is a great way to confirm the type of hack and hacked files/pages. Review this information to look for a WordPress hack, and for a proper WordPress hack removal.
6. Clean the Malicious Scripts from WordPress Files
After the extensive diagnosis of your WordPress hack, list down all the findings. Each file difference, recent modifications, fake users/admins, should be reviewed with the utmost attention. Clean the WordPress core files such as wp-config.php, wp-contents/uploads, wp-uploads, plugin files, theme files, the database, etc.
Here is a list of the comprehensive in-depth WordPress Hack Removal guides specific to WordPress hack symptoms. You can follow them to detect &fix the hacked WordPress:
- Fixing WordPress Redirect Hack (If your WordPress is redirecting to spam pages)
- Fixing wp-vcd Malware (Malicious pop-ups or wp-vcd script in functions.php)
- Fixing Japanese SEO Spam (Google results in Japanese characters)
- Fixing Pharma Hack (Google show Viagra results for your website or your website redirects to fake pharma websites)
- WordPress Javascript Malware Removal (Website loading spam JS or Blacklist warning)
- Fixing Google Blacklist (Google or search engines showing red screen or warning messages to visitors)
- Fixing WordPress Admin Hack (Defaced or you are not able to login to WordPress Admin panel)
- Detecting and Removing Backdoors (Website getting reinfected over time or basic checks after malware removal)
- Fixing WordPress Monetization hack (Strange file by the name monit.php start appearing on your server)
- Fixing push notifications hack (Visitors see malicious/vulgar push notifications when visiting your website)
7. Clean the sitemap
Another cause of a WordPress hack maybe that malicious scripts are residing in your site’s sitemap.xml. An XML sitemap is a file that helps Google crawl all the important pages on your website. Sometimes, hackers inject malicious links into your sitemap. Scan your sitemap for malicious links. If you find anything other than normal, remove it.
8. Clean the database
The WordPress database is where all information regarding your users, site pages, sensitive credentials, etc. resides. It’s a no-brainer that the database makes for a desirable target. Hence, it is extremely important to scan the database too, to find the hack. You can use a malware scanner to know more exactly about infections in your wp_db file.
If you wish to check manually, you would need to scan every one of the 11 tables to find the hack. Search for links/iframes that look suspicious and remove them to get rid of the WordPress site hack. Here is an example of a redirection code inserted into the database:
9. Reinstall
If the site is heavily infected, it’s better to delete the files and replace that with fresh counterparts. That said, reinstalling is not limited to the files only; after the cleanup makes sure to reinstall each plugin. Sometimes due to lack of time or lack of vigilance we tend to store defunct plugins. A hacker benefits from these plugins for they almost always have exploitable vulnerabilities.
Some WordPress web owners believe that deleting the whole website and starting from scratch is a more viable option.
Well, it’s not.
There’s always a better alternative to starting from scratch:
10. Let Astra Help You
If you are an Astra Pro customer, you needn’t worry a bit!
If you are not an Astra customer, you can sign up right now and our malware scanner will identify all the hidden malware and backdoor in your site.
Possible Reasons for WordPress Getting Hack ed
Your website’s security depends on the steps you take to secure it. Following simple security rules can go a long way in reducing your risks online. Here are a few reasons your site may have been affected, and how you can follow better security practices to avoid a WordPress hack:
1. Not Updating WordPress
This is the most basic security measure for a website. Failing to update to the latest version is the number one reason for WordPress hacks. So, always be quick in updating to the latest and patched versions. This patches the known vulnerabilities on your website. WordPress version 5.4.2 is the latest at the time this blog was updated (on 15 December 2020).
2. Hosting on a Shared Server
A shared server may be the cheaper option, but it has costlier after-effects if hacked. Move your website to a safer hosting, and make sure to choose a trusted hosting provider. Make sure to verify whether your provider complies to the best security standards.
3. Using Weak Passwords and Username
Almost all the sensitive areas on your website are password secured. A password made of your own name/your website name and has no numerals/characters is a weak password. Make sure you do not use weak passwords for the following –
- wp-admin panel,
- server hosting panel,
- databases,
- FTP accounts, and
- your primary email account.
Also, change your default username to something unique. Words like admin , your own name , website’s name , etc. are too easy to crack for the attacker.
4. Incorrect File Permissions
Easy file permissions can let attackers access, modify or delete them. In some cases, attackers even held files against ransom. Set the recommended permissions, and make sure to follow the principle of least privilege.
- For files- 644
- For directories- 755
Related: How to fix WordPress File Permissions
5. Unprotected Access to wp-admin Directory
The wp-admin directory is the area from where you control your website. Allowing unprotected access to the WordPress admin directory lets your users/team members perform unwanted actions on your website. Thus, restrict access by defining permissions for different roles of the users. That way no user has the power to do it all. Further, adding layers of authentication to your WordPress admin directory also helps.
6. Outdated Plugins or Theme
Numerous WordPress websites use outdated plugins and themes on their website. Since these plugins and themes already contain known vulnerabilities, it is way too easy for hackers to exploit them. Therefore, if the plugin developer pushes an update, you should be quick to follow.
7. Using Plain FTP instead of SFTP/SSH
FTP accounts are used to upload files to your web server using an FTP client. Plain FTP does not encrypt your password and heightens the risk of someone hacking it. SFTP (SSH File Transfer Protocol), on the other hand, sends encrypted data to the server. So, always opt for SFTP over FTP. You could do this by changing the protocol to ‘SFTP – SSH’ every time you connect to your server.
How do hackers attack WordPress websites?
1. WordPress SQL Injection
WordPress version 4.8.3 and previous ones were found vulnerable to SQL injection attacks. Quite ironically, the $wpdb->prepare() method which is generally used to prepare safe queries was itself vulnerable this time. This meant that plugins and themes that used queries created using this function were also potentially vulnerable to an SQLi attack.
Similarly, the WP Statistics plugin of WordPress with more than 3,00,000 downloads was vulnerable to SQLi. Typically, an attacker can read sensitive tables like wp_users of your WordPress site using SQLi. Although the passwords are stored in an encrypted format, still tools can be used for decryption. This means getting admin credentials to log into an admin’s account in WordPress. In the worst-case scenario, the attacker can even upload a reverse shell using an SQLi leading to a WordPress site hacked.
Related Article – Prevent SQL Injection in WordPress
2. WordPress Cross-Site Scripting
WordPress version 5.1.1 and previous ones were found vulnerable to an XSS, CSRF, and RCE vulnerability. This was a stored XSS vulnerability. The wp_filter_kses() function which is used to sanitize comments, allows basic HTML tags, and attributes like tag combined with the ‘href ‘ attribute. Therefore, attackers can deliver malicious payload like . This would get stored in the database and run every time a user visits this page.
Related Blog – Cross-Site Scripting in WordPress – Examples
3. WordPress Cross-Site Request Forgery
CSRF validation token has not been implemented in WordPress and rightly so because if done, it would hinder the trackbacks and pingbacks features of WordPress. To differentiate normal users from admins, WordPress uses an extra nonce for admin validation in the comment forms.
So, if the correct nonce is provided, the comment is created without sanitization. And if the nonce is incorrect, the comment is created with sanitization. So when an administrator fails to provide nonce, the comment is sanitized using wp_filter_post_kses() instead of the function wp_filter_kses() . Thus, the function wp_filter_post_kses() allows an attacker to create comments with lots more HTML tags and attributes than permissible thereby conducting a CSRF attack.
4. WordPress Remote Code Execution
WordPress versions before 4.9.9 and 5.x before 5.0.1 were found prone to RCE. The vulnerable parameter was the Post meta entry of the _wp_attached_file() 기능. This parameter could be manipulated to a string of choice i.e. ending with .jpg? file.php substring.
However, to exploit this, the attacker needed author privileges. The attacker with author privileges could upload a specially crafted image. This image contained the PHP code to be executed, embedded in the Exif metadata. Script to exploit this vulnerability are publically available and a Metasploit module has been released too!
5. WordPress Directory Traversal
WordPress 5.0.3 was vulnerable to Path Traversal attacks. To exploit this, the attacker needed at least author privileges on the target WordPress site. The vulnerable components was the function wp_crop_image() .
So, the user running this function (is able to crop an image) could output the image to an arbitrary directory. Moreover, the file name could be appended with the directory up symbol i.e. ‘../ ‘ to get the path of the file an attacker wishes to obtain i.e .jpg?/../../file.jpg. Exploits and Metasploit modules to replicate this vulnerability are available online!
6. Buggy Plugins or Themes
It is also likely that a poorly coded plugin is responsible for WordPress getting hacked. Themes by non-reputed authors often contain buggy code. In some cases, attackers themselves release malware-laden plugins and themes to compromise numerous sites. Also, outdated WordPress software can make the site vulnerable thereby leading to WordPress hacked.
Securing Your WordPress Website
1. Secure Practices
- Avoid using common or default passwords. Make sure the WordPress login requires a secure and random password.
- Remove folders of old WordPress installation from the site as they can leak sensitive info.
- Do not use null themes or plugins from unreputed authors. Keep the existing plugins and themes up to date with the latest patches.
- Use subnetting while sharing the WordPress hosting space with other sites.
- Make sure no sensitive ports are open on the internet.
- Disable directory indexing for sensitive WordPress files using .htaccess.
- Restrict IPs based on countries from where you detect heavy bot traffic on site.
- Follow secure coding practices if you are a developer for WordPress.
- Use SSL for your WordPress site.
- Always keep a backup of your WordPress site separately.
- Rename the wp-login.php into a unique slug.
- Use two-factor authentication to log into your WordPress site.
2. Use a Security Solution
A firewall can help in securing your WordPress site even if it is vulnerable. However, finding the correct firewall according to the diverse needs of WordPress can be tricky. Astra can help you in making the right choices from its three plans of Essential, Pro, and Business. No matter you use WordPress to run a small blog or a corporate site, Astra covers every ground for you. Moreover, the Astra security solution scans and patches your vulnerable WordPress site automatically. Just install the Astra plugin and your site is secure again.
Try a demo now!
3. Security Audit and Pentesting
As seen in the article, vulnerabilities in WordPress will arise from time to time. Therefore, as a precautionary measure, it is advisable to conduct penetration testing of your website. This will reveal the loopholes to you before the attackers can catch up on your site’s security. Astra provides a comprehensive security audit of the complete WordPress site. With its 120+ active tests, Astra gives you the right mix of automatic and manual testing.
