Blogosphere Alert: Prevent your WordPress blogs from being hacked!

Reading time: 6 – 10 minutes

I was surprised knowing today that my blog was almost hacked.¹ The situation had shaken me that I almost freaked out but the good thing is that I’ve managed to put myself back together. I told myself that this could not happen so I didn’t panic instead I collectively put my thoughts into tracking the traces of the hacker on my site, and figuring out how it became possible.

The Discovery
I was editing previous posts when suddenly right after hitting “Update Post”, I became curious to check the post attribution drop down option. To my amazement, I have seen two other names on the drop down option which are not even contributors nor editors on this blog. When I checked the “user settings,” it became clear to me that there were really two guys with obscure names registered on my blog both marked as “admin.” While it had me marked as “administrator” with all the posts attributed to my name, it came into me that there’s something I needed to find out how these guys where able to register on my blog.

The Tracking Begins
I went first into the General settings. I found out that the “anyone can register” option box was ticked. Perhaps, that became their point of entry into my blog so I unticked it and saved the settings. So guys, don’t place the “Meta widget” on your webpage and don’t allow anyone to register especially when there’s no pre-defined user privileges or multiple users in your blog.

A bit paranoid that I am, I’ve decided to change my admin username and password. Changing WordPress default username “admin” to your preferred name can give you more protection since if you leave it at default “admin“, hackers would only have to figure out your password via brute force recovery and voila! You’re screwed. If you don’t have any idea how to change the default username “admin” in WordPress, follow these simple steps:

1. Back up your database first. This is the most important thing to do because you would not want your hard work go to waste.

2. Use phpMyAdmin to access your database.

3. Select the table labeled WP_Users, click the browse icon and select the record labeled Admin and click edit. The edit button looks like a pencil.

4. Go to the field labeled user_login and change the name to your preference. Save the changes.

5. Log out and login again to verify the changes.

If you don’t want to get into modifying it via phpmyadmin database, you can use a plugin to change admin username in WordPress found on www.w-shadow.com.

The next thing I did was to check if there had been some changes in the php scripts particularly in header.php file. Good thing is that I’ve found no trace of suspicious codes within the scripts, so I’m good. You can view here an example of a wp-blog-header.php file that has been hacked. I’ve also checked .htaccess file but it seems clean.

I’ve also downloaded the WordPress Exploit Scanner plugin which searches the files and database of your website for signs of suspicious activity, although its not a guarantee that it would stop anyone from getting into your site’s backend but it may help you figure out any uploaded, modified or compromised files left by a hacker.

Also, I have edited wp-config.php and created the SECRET_KEY, i.e., define(‘SECURE_AUTH_KEY’, ‘You unique phrase here’); a password containing elements that would make any hacking attempt unsuccessful to penetrate a security barrier since it generates a code that is almost impossible to decipher. Get instructions on editing wp-config.php here.

Lastly, I’ve made a backup of my database and files. If you need help on backing up your database, go seek your webhost for assistance as there are so many ways to do this depending on the MySQL version you are using.

There’s so much information overload here since internet security nowadays can really screw up anything you’ve accomplished in just a breeze. Don’t be a victim. I may have been saved for the day but who knows so I’m paying much attention to details now while doing a lot of extra protective measures. What happened was a false alarm though I’m keeping myself extra vigilant. So, do yourself a favor and learn as early as possible while you still have the chance. I cannot emphasize this more than enough because we’re all vulnerable here.

The Advice
To sum up, I can simply advice you to remember the acronym–B.U.C.K.S

B–Backup database regularly.
U–Upgrade to the latest version of WordPress if you haven’t. I haven’t upgraded yet but eventually I would. I’m still looking at some factors especially the plugins because they are the ones mostly affected during upgrades aside from bugs. So far, I’m fine with 2.7.1 and I’m keeping my blog secured. It is advisable that you upgrade once your blog has been hacked.
C–Configure wp-config.php for added security.
K–Know how to do simple php script and database editing. It’s pay a lot to learn.
S–Seek help when needed. Don’t pretend that you know all things. It doesn’t hurt to ask questions.

That’s all for now, I’ll keep you posted once I’ve found out something new. Cheers!

P.S.

While finalizing this post, I just came across this plugin called Login LockDown, an enhanced login security plugin that records the IP address and timestamps of every failed WordPress login attempt within 5 mins. After three unsuccessful attemps, all requests from that range of IP will be disabled as this prevents brute force password discovery.

The IP lockout time is set to a default of an hour but is modifiable via the options panel and administrators can also release locked out IP ranges manually. Login LockDown is downloadable from this link: http://www.bad-neighborhood.com/login-lockdown.html (Just copy paste the URL into your browser).

This post was originally posted on 16 June 2009 but for some reasons, the post disappeared from the exported WordPress XML file containing all the posts, comments, etc. so I had it republished.

Update
A few hours after this post went live, I went back to this site to check how it was doing in terms of views when all of a sudden I got struck when all I’m seeing was ”Index of/” when I type this blog’s URL on the browser. I contacted my host about this matter and they told me that the index.php file was missing.

Findings
1. My blog was hacked. The index.php was compromised by unscrupulous cyber criminals trying to stop me from exposing the realities of today’s Wordpress blogs from this vulnerability. Here’s the screenshot of the index.php after it was compromised:

Yes, silence is golden but this incident just awakened my spirit and flared up my eagerness to continue writing. It seemed like somebody wants me to shut up but whoever they are, I’m just getting started.

Suggested for further reading:

1. Twitter Bombarded With WordPress Users Must Tweets Reading time: 2 – 4 minutes I have never...
2. Secure Your Blogs: Upgrade to WordPress 2.8.5 Reading time: 2 – 2 minutes Just recently, the...
3. PHP Script Vulnerabilities and WordPress Blog Hacking Reading time: 3 – 4 minutes Based on my...
4. Keywordluv WordPress Plugin and Commenting On Do Follow Blogs Reading time: 3 – 4 minutes The first thing...
5. TinyMCE/Visual Editor Quick Fix for Self-hosted WordPress Blogs Reading time: 3 – 4 minutes My problem concerning...

Did you enjoy this article? Please subscribe to Software Critics via RSS or Email to receive all the FREE updates!

Tagged as: avoid blog hack, blog hacking, blog threat, hack, open source, prevent blog hacking, stop blog hacking, website threat, WordPress, WordPress attack, WordPress hack, WordPress security attack, WordPress security threat, Wordpress vulnerability

19 comments