How to prevent hackers to insert html file into /wp-content/ folder

Richard G said:
Only Wordfence? Did not try Maldetect of any of the ones mentioned by others? Could not harm just to be sure.

But it's good you changed everthing to 755 resp. 644.
Click to expand...
Yes, I ll try some other software suggested above too, but Wordfence does not scan on my website when doing it manually; it keep scanning for ever, it only scan itself, and found no hacking files. Now I have to remove Wordfence from my website because it added 25 database tables slowing down my website.
 
Johnws2022 said:
Hi All,

Just update what I have found. I found nothing after running Wordfence, My conclusion is /uploads/ folder was set at 777 which allowed everyone or hacking to have writing permission; it mean they can modify or insert any files into the server,

In order to avoid this for WP website owner:

1. Make sure all folders are set at 755, and files are set at 644, in particular:

/wp-content/
/wp-admin/
/wp-includes/

2. All folder under /wp-content/ must set at 755 too:

/wp-contents/themes/
/wp-contents/plugins/
/wp-contents/uploads/

and all others inside /wp-contents/

3. All folders under /wp-admin/ and /wp-includes/ should be 755 and files at 644.

4. Failure of doing the above, hackers enjoy attacking your websites.

When should you do that?

When you restore your website from a backup on a new server or the same one because file/folder permissions are normally set back to 777/666, etc.


Many thanks for this such a great community.
(I will try Rechard's advice to install a protection on SSH)

Cheers
Click to expand...

wp-config.php and all derivatives I set at 640 as the public shouldn't have any read access to it if they were ever to get access to it.
 
You need to get a timestamp for when the files were added.

Then scour your logs to see what was being done around that time on the account.

A lot of times this leads to another "file that shouldn't be there", so you have to timestamp it and scour the logs... rinse repeat until you come upon the culprit.

I will also reiterate that if you're using outdated or abandoned plugins or themes... that's probably going to be your culprit. And if you wish to continue to use those outdated or abandoned plugins or themes, then you're just going to have to live with these compromises (as long as your web host continues to allow it).
 
If you still don't know..... just manual log the payload request
Code: 
$_REQUEST
$_FILES
file_get_contents('php://input')
(these variable should contents all possible payload )

using "auto_prepend_file" directive feature with PHP script to keep the logs in the secret location and monitor it which's request insert that HTML file.
 
You must log in or register to reply here.
Back
Top