WordPress is the most popular content management system on the web. Besides the popularity, it has many advantages. But unfortunately, it comes with certain downsides as well. if you go by statistics, more than 70% of WordPress installations are vulnerable to hacker attacks.
In WordPress websites, we generally install third-party plugins/themes for integrating additional features. But most of the time, we are not aware of the inherent security vulnerabilities of these plugins/themes which act as critical loopholes that are targeted by hackers/malware botnets, etc. Some plugins provide regular updates for patching those issues. But if we fail to do them, it leads to the exploitation of the vulnerabilities and severe malware infection.
……………………………………………………………………………………………………
Why secure WordPress websites before enabling SEO?
We know that bots crawl websites. But nowadays, bots make more visits to websites than human traffic. Malware Bots attack by trying a set of tentative URLs on websites. If a website has a vulnerability, and it gets figured out by the malware through this approach, the website becomes a candidate for exploitation. So, before enabling SEO on a website, we need to make sure that the website is secure; otherwise, you are at the mercy of bad bots which will take advantage of it. In some cases, malware can damage a site’s relationship with leading search engines by injecting malicious contents.
Effects of Malware Infection:
- WP-admin will not be accessible due to unwanted 302 redirects to third-party malicious websites.
- .htaccess file content will be changed even though it has proper file permission.
- Files with extension .php.suspected will be created along with many duplicates of stylewpp.php.
- Random posts will be created in WP DB.
- Unknown admin users may have been created.
Steps to prevent Malware Infection :
- Take a regular backup of codebase and database.
- Restore content of .htaccess file and set proper file permission.
- Check crontab for any suspicious entries.
- Kill suspicious processes on the server.
- Check the access log and find suspicious HTTP calls.
- Block suspicious IPs which are making malicious attacks.
- Most core WordPress files should never be modified. You need to check for file integrity issues in the wp-admin, wp-includes, and root folders. Remove unknown files & folder with cascade delete [Suspected from access log]
- Analyze malicious PHP code which is injected into WP folders. It would be great if you can analyze malicious PHP script and decode their intention which will help you to remove infection easily.
- Prevent random article creation. We found “content-main.php” file to be executed by malware botnet from access log. It was injected in path “/wp-content/content-main.php”.
- Remove suspicious admin users
- Update WordPress to the latest version
- Change all credentials of cpanel , FTP and DB.
- Stop the brute force attack. Even if you will remove all files, folders, kill all malware processes & change passwords, malware will never sit idle. Because it has already entered your site domain name, IP & malware file locations in its database. So it will try to make continuous HTTP calls to malicious PHP script locations which will return 404 error which is fine. You also cannot block all IPs of malware botnet because it keeps on changing IPs.
It tries the bruteforce login page with breached admin user names against a global database of pawned passwords. - Block xmlrpc
- Prevent bad bots
Modify the robots.txt file to prevent crawling core directories along with themes/plugin directories. Also, identify bad bots and prevent them from crawling website pages. - Use SFTP instead of FTP
- Change default wp-login, wp-admin, wp-content urls. Below are some of the WP plugins which you can use for changing url of wp-login, wp-admin, wp-content, plugin urls.
WPS Hide Login
Protect Admin - Install any of blow WP security plugins.
Securi
Quttera Web Malware Scanner
Wordfence - Add proper file & folder permissions.
- Check for known vulnerabilities in existing installed plugins.
https://wpvulndb.com/
……………………………………………………………………………………………………
Conclusion
Nowadays, malwares are getting injected by botnets instead of humans. They crawl for vulnerable urls and exploit them one by one.
……………………………………………………………………………………………………
The views and opinions expressed in this article are those of the author. Lakin enjoys sharing his thoughts on computing and technology in his personal blog.
To know more about our company, please click on Mindfire Solutions.
