It’s been two years since I’ve been blogging with WordPress. All the knowledge and articles I wrote in this blog come from many sources and experiences. In those 2 years of blogging, I survived 2 hack attacks. And if I pay attention to my access log now, there are still some attempts to inject malicious code into my site. You can read my article: Someone Trying To Inject IvanKristianto.com.
I’m not saying that my blog is secure and bulletproof. But I have done everything I could, trying to secure my blog. I’m not an expert in security. But I want to share my experience when my blog got hacked, and I hope that you can fix it and rise again.
From my experience, what they have done is inject malicious code that can control your website. First they try to find the vulnerability hole in your blog, then inject the shell code. Usually they use c99 shell code, which acts like a control panel (cPanel). So they can have directory access and database access — and I think that means the whole website including all sites under subdomains or addon domains. They can control everything.
In my case, they successfully injected their malicious code through my addon domain, which was not secure enough, and they took control of my main website. What they did was not steal anything, but they made web content forgeries which mirrored an Australian bank site and spammed the links. It was a nightmare. I found out 2 hours after the intruders successfully injected my website.
So what did I do after my blog got hacked? Here are the tips:
- Block all access to your blog, and subdomains too if they exist. Exclude your own IP address so only you have access to your site. For everyone else, redirect to 503 or under maintenance.
- Pay close attention to your access_log from your cPanel or Apache. (Hope that they didn’t delete the access log.)
- Change all your passwords immediately!
- From the access_log you can find out where the shell file is. Last time they changed my labels.rdf file. So I would suggest overwriting all the WordPress files with the official files.
- Purge all cache files and delete cache folders. Create fresh ones.
- Download the entire wp-content folder and open files one by one, checking for any malicious files — usually in your upload and plugin folders. Or back up your whole website and download it to your computer and scan it.
- Update all your plugins and WordPress core if not up to date.
- Record all IPs that accessed the malicious shell file, and block them with a firewall or .htaccess. You don’t need visitors from those IPs.
- If you think your blog is clean, upload everything back. Release the block from .htaccess. Keep paying attention to your access_log every 1-2 hours for 7 days. If something goes wrong, block it again and scan again. Until you feel it’s safe.
- Ask your hosting provider support to help you out. Or pay a security expert that you know.
- Upgrade your knowledge about security, so you know a little bit and know what to do when you get attacked.
Once again, I’m not a security expert. But what I have done is just survive the hack attempt. And I want to share my experience with you — it may help you someday, or someone who comes to this article because they’re having such trouble.