Whenever you think Content Management Systems (CMS), you think WordPress. And that is so because this website and blogging platform are so efficiently fast and it almost rules over 25 percent of the market share. All large and small organizations seem to be totally relying on WordPress, but they must also be aware of the security compromises that may take place.
Many a time, site owners or site administrators may choose to overlook the warning signals that tell that there is probably a red-alert kind of situation with the site. This can happen when site owners are not very well aware of the fact that the security aspects of a site have to be updated at regular intervals and that losing/manipulating site data can cause a significant blow to their business.
Let us have a look at the common indicators that tell us if the site has been hacked or not.
Now, if you happen to find out that your website has been hacked, keep reading on. We will tell you about Sucuri security plugin which is a security offering from Sucuri website security stack. Let’s know more about how Sucuri can help.
Scan your site to find malicious payloads and malware locations. Here’s how you can do it.
You can continue with other tests in this section if the remote scanner isn’t able to find any malware issues. If you want to, you can also manually review the iFrames / Links / Scripts tab of the Malware Scan to look for any suspicious component. You are required to scan all the websites if you run all of them on the same server in order to keep a check on cross-site contamination. You can also isolate your isolate hosting and web accounts, which is advisable.
The Sucuri security plugin checks for integrity issues in the wp-admin, wp-includes, and root folders to see if any of the core WordPress files have been modified. Our plugin checks for integrity issues in the wp-admin, wp-includes, and root folders. In order to carry out this step, follow these steps.
The Sucuri plugin can check the audit logs and identify if any modifications have been made. View the Audit Logs section for any unfamiliar recent changes in the last 7-30 days. If there is any, it’s a red flag. Also, check if any passwords were stolen or maliciously created. To do so, go to the Dashboard and see the list of users and the time they logged on. If you find any unusual activity, your site can be hacked.
Now that you are aware that your site is hacked, it is time to protect your core files and plugins. Sucuri security plugin now comes to your rescue. To remove a malware infection from your website database, use your database admin panel to connect to the database. You can also use tools like Search-Replace-DB or Adminer.
After you have fixed your hack issues, request a review from Google, McAfee, Yandex etc. (if they have blacklisted you). The review process can take several days. Now, update your WordPress software and if the Sucuri plugin identified other outdated software on your server (i.e., Apache, cPanel, PHP) you should update this as well to ensure that there are no security patches missing. Now change passwords for all access points such as user accounts, FTP/SFTP, SSH, cPanel, and your database. To do so, Log into WordPress as an admin and go to Sucuri Security > Post-Hack.
Once the passwords are reset, force all users to log off using Sucuri plugin. Force active users off by resetting your WordPress secret keys. To generate new secret keys,
Reinstall all plugins after a hack to ensure they are functional and free of residual malware. If you have deactivated plugins we recommend you remove them from your web server. Note that premium plugins will need to be reinstalled manually as their code is not available in the official WordPress repository.
Here are some tips to help you with website backups:
You can opt for paid antivirus services such as BitDefender, Kaspersky, Sophos, F-Secure. For a free one, Malwarebytes, Avast, Microsoft Security Essentials and Avira are good options. Finally set up a Website Firewall to prevent a future hack and block Brute Force Attack. You can also go for the Sucuri Firewall. And simply connect it to the WordPress plugin using the Firewall (WAF) tab of the Sucuri plugin.