Jak znaleźć backdoora w zhakowanej witrynie WordPress i naprawić go

47 komentarzyZostaw odpowiedź

1. Jiří Vaněk

   It is also very good practice to contact the web server provider. They often have sophisticated malware detection tools and are able to scan the entire web and send a dump of infected files. This is what I would possibly recommend doing any time a website hacking problem turns out to be true. A provider can help a lot with this if they have good customer support.

   Odpowiedz

2. Paul Booker

   If you have version control installed on your web server –– it is possible to very quickly determine if any of your files have changed, or additional files have been added, by running a simple command in your shell terminal.

   If you are using Git for version control you just need to type „git status” into your shell terminal, to find out what has been hacked. You can the delete all of the changes with one command „git checkout — .”

   If you don’t have version control you can basically just write a simple command „list all files modified in the last 7 days” which would be „find ./ -type f -mtime -7” and again you can find out what has been hacked. You can then manually delete the changes.

   Odpowiedz

   • WPBeginner Support

     While possible, that is not a beginner friendly method so we do not recommend it for most users.

     Odpowiedz

     Administrator

3. Vivek Tripathi

   Hello Sir in our maximum sites there was malicious codes injected but I Haven’t find these anywhere in database. In my all sites there was automatically malicious pages generated and it will shown on google and these pages were not shown in my wordpress dashboard and in posts sections.
   Please Help me to find codes and get secured from this hacking I have losted many traffic from my Wordpress site.
   Please Help Me!

   Odpowiedz

   • WPBeginner Support

     Hi Vivek,

     Please see our article on how to clean a hacked WordPress site.

     Odpowiedz

     Administrator

4. Abraham

   This is really the BEST post there is about „unhacking” your website, I don’t know if it worked completely with my site but I really do hope so.

   Thanks so much guys!!

   Odpowiedz

5. Azwan Abdullah

   Hi! I need some opinion. I’ve enabled open registration and set the default role as subscriber. From my understanding, this role can only have read capabilities. Means that they can only read posts on my blog, and comments. Am I right?

   The purpose I’m doing this because I want to allow only registered people to comment. Ironically, I’m using some live traffic logger, which can track requests in to or out of my website. I noticed that the registered user is using anonymous IP from TOR network. They seems registering by accessing the register page directly, not by usual means.

   Therefore, is it usually safe to let them? Does they (subscriber) has the capability to upload something on uploads or any folder on system? Since they can also have limited access to admin dashboard, can view wp version, is it considerably safe?

   I hope someone and wpbeginner staff can respond these. Thanks in advance.

   Odpowiedz

   • WPBeginner Support

     Hi Azwan,

     You need to protect your website from spam user registrations.

     Odpowiedz

     Administrator

6. Pradeep Gauda

   Hi ,
   I found my word press website title changed by some hacker group as they mentioned . So checked my security plugins wordfence , did the scan but nothing found . How can they affecting the page title continue and what should i do for that .

   Odpowiedz

7. Colin

   Hi
   Sucuri & WP Clone uses the Uploads folder so what are we suppose to do there?

   Also Exploit Scanner is coming up with loads of files that it doesn’t recognise and the plugin is up to date. Maybe the algorithm is not up to date with the latest version of WordPress so deleted it.

   Sucuri has found no problems but it is the free version, Wordfence have found no errors either so I don’t trust Exploit Scanner at the moment.

   Colin

   Odpowiedz

8. Jo

   Thank you for a very informative and helpful article. I was able to finally understand what happened to my website ( thousands of malicious index.php files).
   I avoided having to pay an extortion price to sitelock to repair my site, by simply installing a (clean) backup.

   And now, I will make sure to install hundreds of antivirus plugins. Had not realised that my webhost bluehost did not include any basic level of security.

   Odpowiedz

9. Mehreen

   Hi,
   I understand this article is quite old now, but I’ll comment and try if I get response.

   My site was recently compromised and after using free Sucuri, I switched to Wordfence. The latter helped me track all my files containing malicious code. No particular reason to not use Sucuri, I was just trying different options.

   What are your views on wordfence vs sucuri? Paid versions.

   Thanks.

   Odpowiedz

   • WPBeginner Support

     Hi Mehreen,

     They both offer good security. We recommend Sucuri because they offer cloud based website application firewall, which not only protects your website but also improves performance. Wordfence offers an application level firewall which runs on your server. See our article on best WordPress firewall plugins for more details.

     Odpowiedz

     Administrator

10. Mohammed Jaid Ansari

    Hi
    When i type my website address it will open and after some time he will redirect to other website. and in mobile when i type my website address directly he will redirect to google play store. and google also showing this website may be hacked. how i can solved this problem.

    Odpowiedz

    • WPBeginner Support

      Hi,

      See our guide on how to clean a hacked WordPress site.

      Odpowiedz

      Administrator

11. Christine

    I cannot get in to my Wordpress website. I spoke with the server’s tech support and they said the problem is not on their end, and they suspect the site has been compromised by malware. However, I am not able to log in the site to check anything. Any advice?

    Odpowiedz

    • WPBeginner Support

      Hey Christine,

      Have you tried resetting password? Also see our guide on what to do when you are locked out of admin area.

      Odpowiedz

      Administrator

12. greekouzina

    Hi all,
    my website was hacked and i found many .php files like kebin.php kevin.php with eval and base64 code inside.
    The worst thing is that my site was blacklisted and also the external references to the link are so many!
    I noticed about 5 foreign IP’s that look into that reference files!
    What can i do to cut off these references?
    I have sucuri free version cause my blog is amateur blog and i dont have money to spend.
    TIA

    Odpowiedz

    • WPBeginner Support

      Cleaning an infected website can be a bit difficult for most beginners. You can try steps mentioned in our guide on fixing your hacked WordPress site.

      Odpowiedz

      Administrator

13. Sandy

    someone hacking my admin panel again and again. I recovered but still he is hacking my admin-panel. I dnt know how to solve. Please kindly contact me for a solution.

    Odpowiedz

14. Leo Dimilo

    Just got finished cleaning up a client’s website. One of the things that this article doesn’t address is the fact that you may have to go up a level in your server’s folder to find the backdoor. In other words, you could delete everything in your /html file on your server and restart with a fresh reinstall and still have a backdoor in because it is in a different folder on your server one level up….

    Odpowiedz

15. Saad Amir

    Dear,

    My website is hacked by someone. Only hack my posts, when i click on post for preview it would not be open, open as blank page.

    Please help me, what is the main problem how i can solve it

    Odpowiedz

    • WPBeginner Support

      Try switching to a default WordPress theme like twenty sixteen and deactivate all your WordPress plugins. Try to preview a post, if it opens fine, then your theme or one of the plugins on your website is causing the issue. If the problem persists, then follow the steps described above.

      Odpowiedz

      Administrator

16. Joy Healey

    Hi,

    This sounds to be really useful, but I’m struggling (on their website) to find the option you mention:
    „They will monitor your site, and clean it up if you ever get hacked. It comes out to be like $3 per month per site if you get the 5 site plan.”

    Could you point me in the right direction, please – with your affiliate link, of course?

    Or perhaps it’s no longer available, which would be a shame – because that’s affordable, whereas all I’ve found at the moment is about $17 per month which is a bit of an ouch for more than one site

    Thanks for a helpful article, Joy

    Odpowiedz

    • Joy Healey

      Answering my own question above…. I checked with Sucuri and sadly the 5 site plan referred to in this post no longer exists.

      Odpowiedz

17. Robin Jennings

    Great article- Sucuri is a fantastic program. It isn’t the cheapest option but they are onto issues within hours and a fix shortly after.

    I’ve found a few exploits on clients website in the public_html/images file lately.

    Odpowiedz

18. Thomas

    Hey there,

    for guys who are familiar with ssh: what I do if there are hack problems is having backups ready for my complete websites and just compare the complete backup with the current state of the live project.
    Still the corrupt files can be 'sleeping’ in there for weeks or months, so it’s not 100% safe that one will find all the hack(ed) files, but it’s often a good indicator, where to look. This way I noticed 3 new files in a long time not updated avada(theme) project inside the revolution slider plugin.

    Just my 2 cents :). Have a nice day,
    Thomas

    Odpowiedz

19. Jon Schear

    You can use the Sucuri scanner for free, but it is very complex with the results you get.

    Odpowiedz

20. Rodney Wild

    Came across another signature: if(!isset($GLOBALS[„”\x61\156\x75\156\x61″”]

    if you find the above statement, remove from the „if” right till the end of the line and that will fix that one file. I found this in almost every file though so you are going to have to use a global find and replace program. I use FNR.EXE but there are others. This one will also infect multiple websites in the same tree.

    Odpowiedz

21. Kushal Jayswal

    Anyone noticed recent attack before a weak on major servers. I am using Hostgator hosting services. My sites were down for a day. One of my friend is using Bluehost and his sites were down for 4-5 days.

    I couldn’t find news about this on Google.
    Did anyone notice?

    Odpowiedz

22. Michael

    Great Post, still relevant. I got malware the other day and downloaded my site to my computer. I sorted the files by „last modified” which showed me the pages that had been compromised.

    I compared these files with backup files and was able to track down the malware!

    Odpowiedz

23. Azman

    Nice post, I recently run exploit scanner and it found many malicious or suspecious codes in my site like eval and base64_decode. What should I do in this case do I need to setup my whole database from starting. I can do this because my site is not full of content.
    But I am not very familiar with php, so help me.

    Odpowiedz

    • WPBeginner Support

      Exploit scanner lets you know where it found the malicious code. If it is in a theme or plugin file, then you can simply delete those theme and plugin files. After that you can download and upload fresh copies of those files to your site. If it is in database and you can start fresh then do that. Other wise there are ways to clean the code from database too.

      Odpowiedz

      Administrator

24. Dionisis Karampinis

    Very nice article many thanks! I have used Exploit Scanner and currently im having BPS Security

    Odpowiedz

25. Matthew Baya

    Nice article. I’ve found on infected WP sites they consistently seem to put a file named https.php in the wp-includes folder. I also found on my shared hosting server they will hop from one infected account to find other world readable wp-config.php files in other WP installs and will use the database information there to create admin accounts on other WP installs. Thus I’d add that any one whose been hacked should change their database credentials and also lock down wp-config.php as much as possible, ideally limiting it so only the webserver user (and the owner) can access it.

    I’ve been using wordfence to clean infected sites and have been very happy with is, though I recently found it’s no longer noticing the /wo-includes/https.php file I mentioned earlier. I’ve contacted them about this since i know in the past it did notice these

    Odpowiedz

    • Nora McDougall-Collins

      I recent infection I had to deal with infected all the index.php files.

      Odpowiedz

26. qammar

    Very helpfull and informative article.

    one of my client website/blog was infected with malware was 'reported attached page’ by google. first I tried sucuri sitecheck tool to identify the infected files/badware but they only show this result of scan

    web site: blog.myclientwebsite.com/
    status: Site blacklisted, malware not identified
    web trust: Site blacklisted.

    This do not any help, as we already know the site is black list and then I scan all the data on domain and found following two files infected

    wp-includes\js\js\cnn.php
    wp-includes\js\js\rconfig.php

    I am posting this for other people to look for these files, if their website is infected and reported as attack page.

    Cheers,
    qammar feroz

    Odpowiedz

    • Editorial Staff

      The free Sucuri scanner doesn’t do server side scanning. If you actually pay for Sucuri, not only it protects you, but they will do the cleanup for you if anything happens.

      Odpowiedz

      Administrator

27. Nora McDougall-Collins

    Thanks for the excellent article! I have passed it along to my web development students through Facebook!

    Also, one of my student’s site was hacked and shut down by the web host for the second time. It looks like he had being doing his database backups. So, it looks like we will have to copy and paste his posts directly into the Dashboard from the database dump. What fun!

    Odpowiedz

    • Nora McDougall-Collins

      Sorry for the incomplete information – he had NOT been doing database backups. So, we will have to dump the database and copy and paste into the new install.

      Odpowiedz

28. Patricio Proaño

    Excellent! Thank’s for the info, very useful!!

    Odpowiedz

29. Pat Fortino

    You don’t have to pay securi anyting to scan your site. You can scan as many sites as you want for free. That scan will tell you where the hacks are.

    Odpowiedz

    • Editorial Staff

      Not quite correct. Yes, they have a free scanner, but it only checks if the hacks have a front-end impact. For example, it will say that you have malware injections in your front-end, but it will NOT tell you where the backdoor is hiding and such. There are times that you might clean up the hacks results, but the backdoor still stays even after the cleanup. Then when it comes back, you are left to wonder why.

      Odpowiedz

      Administrator

30. Andrew

    Nice guide. Have you looked at Wordfence (http://www.wordfence.com/)? I’ve put a lot of customers on to it and they rave about it.

    Cheers,

    Andrew

    Odpowiedz

    • Editorial Staff

      Never needed to try it. Sucuri is highly recommended by many big brands. Having using them for a while, we can say that they are very good.

      Odpowiedz

      Administrator

    • Gautam Doddmani

      thanks i am already using the plugin, eliminated many plugins because of it. real time scans are great and so is its firewall

      Odpowiedz

31. Harry Candelario

    this was EXACTLY what I needed!! I’ve been trying to figure out how a hacker kept getting into one of the sites I maintain… it was just this one site, none of my other sites were being hacked. I found it with your help. It was hiding in a Pinterest plugin.
    thanx again

    Odpowiedz