For the “average” WordPress user, there are two main security vulnerabilities that I’d classify as “general” which really have nothing to do with WordPress itself.
- Your local network/machine
- Your Web Server (shared, Reseller, vps hosting)
Local Network/Machine: When it comes to your local network/machine, you simply need to keep things clean and up-to-date. It’s a good idea (especially on a Windows machine) to regularly run a full malware and anti-virus scan. And keep that software up to date! Including your router’s settings/firmware. If you’re not keen on investing in anti-virus software, you can use this article to help you locate and delete infected files.
I’m sure all of us here who are using WordPress are aware of Premium and free WordPress themes and their advantages and disadvantages. And also, many of you are aware that you can easily find any Premium WordPress theme on torrent or warez site. Many bloggers, don’t even realize that these hacked WordPress themes are slowly effecting your blog, as many of them contains encrypted links, code. In this post we will look into some potential drawback of using hacked WordPress themes on your blog.
Potential Harms of Using a Pirated hacked WordPress Theme
Pirated copies of premium wordpress themes such as Woo, Elegant, Studiopress, Wp-Now are easily available on many websites and these are easily downloadable. An ignorant person becomes happy getting top class premium themes free of cost but he/she doesn’t know the reality of these free copies of themes.
Most of free downloadable premium pirated themes have malware and hacking scripts
Below are the possible harms of illegal copies of WordPress pro themes
- Theme company may take legal action against you.
- Your web host may suspend your hosting account.
- Your wordpress may get adwares controlled by a hacker and your blog will show unknown advertising.
- Your blog may be controlled by a hidden administrator.
- Your blog may be completely stolen.
- The anti-virus and anti-spyware softwares can block access of users to your blog.
- Google and other search engines may flag your computer as a harmful website.
- Google and other search engine may remove your website from index permanently.
Why use a Hacked WordPress Themes to save some dollars only?
With a successful blog you can earn thousand dollars per month. But your pirated theme with hacking and malicious codes may destroy your successful blog within few days only.The blog which is giving you a big amount of money will be stolen in few minutes and you will only rub your hands with feelings of great dejection.Your blog will be disappeared from search engines being declared as a spyware website. Security softwares will block your blog on computers.
So, you have been hacked? Now what? 5 Critical Steps
Getting your website hacked is a big deal and it can be fairly complex to clean it up. But here are the high-level steps that you and / or your support team should take once you discover that you’ve been hacked.
1. Stay calm
First of all, stay calm. You can recover.
2. Call in your support team
If you don’t have the right technical expertise on staff, your best option will be to call in a support team. Ideally, this will be someone with both strong technical expertise as well as someone who is familiar with your site and its configuration. This can include your web developer and/or your hosting provider.
Web designers without a programming and technical background may have a harder time assessing the issue and fixing it. Experienced web developers (e.g. programmers) should have the necessary skills to assess and fix the problem.
Many hosting providers will not do the actual work of cleaning your website. But they can provide invaluable assistance or may have other customers that are experiencing the same issue.
3. Pull together the information your support team will need
You will need to get your information together for your team. Your developer / team will need access to:
- CMS Login: your content management system with administrative / super admin rights
- Hosting Login: your hosting control panel to access your database and web logs
- Your web logs: both the access logs and error logs. Be sure that your hosting company provides the web logs. Most web hosts do, but a few hosting companies do not turn those on by default or may not provide access to them.
- FTP / sFTP access credentials: this should include the hostname, username, and password
- Backups: Any backups you may have
You should consider keeping this information together in a safe location that you can access quickly in case the need should ever arise.
4. Take your website offline
You should temporarily shut the site down while it is being assessed and fixed. Your hosting control panel may have the ability to temporarily turn off your site. Or you may need to password protect the main directory where your website resides to block visitors from accessing your site while the team works on fixing it.
5. Scan your local computers for viruses and malware
You will want to scan your local computer(s) with your anti-virus software to make sure they aren’t infected with malware, spyware, Trojans, etc. Be sure your anti-virus software is up-to-date before using it to scan your computer.
The Cleaning Process
Your support team will hopefully be fully engaged by now working to diagnose how the site was hacked and then work to clean up and restore your site. Here is a sample of what they will be doing:
- Changing your passwords for website logins, database, ftp, etc.
- Making a backup of the site and downloading it for inspection
- Examining log files and other data to determine how and when the website was hacked
- Examining the software extensions used on the site and ensuring they are up-to-date and do not have any known vulnerabilities
- Reviewing any custom software code (if applicable) for any obvious security flaws
- Cleaning the site and putting it back online.
It is very important if at all possible to understand how the site was hacked so that it can be properly cleaned. I’ve seen a number of websites that were repeatedly hacked by the same hacker until the proper fixes were in place.
Conclusion
Getting your website hacked is no fun. But you are able to recover from it. So stay calm and call in the right support team to get it fixed and running again. While we’ve just skimmed the surface of the process needed to clean the site, having the right support team in place can make a big difference.
More Tips:
Useful tips to Secure WordPress from Hacker
