Getting hacked sucks, plain and simple. It can affect your rankings, cause your readership to be exposed to virus and trojan attacks, make you an unwilling promoter to subject material you may not actually endorse, and in many cases cause the loss of valuable content. However, once it happens it is usually best to not procrastinate on the clean up process, since a speedy restore will most times minimize the damage that was caused.
While almost all sources will recommend that you upgrade your WordPress to the latest version, what the majority neglect to tell you is that in most cases simply doing so will not prevent the attackers from getting back in, even if there are no known exploits with the latest version. The hackers may have left a back door file hidden in a directory where it wouldn’t get overwritten with an upgrade, or inserted code into your theme, or simply created an account that they then granted admin privileges to. Any one of those would allow them back in, even after you patched what was wrong the first time. Therefore I am providing this step by step process on how to completely clean out and restore a WordPress installation that has been hacked.
1. Backup the site and the database.
Even a hacked copy of your blog still probably contains valuable information and files. You don’t want to lose this data if something goes wrong with the cleanup process. Worst case scenario you can just restore things back to their hacked state and start over.
2. Make a copy of any uploaded files, such as images, that are referenced.
Images are generally exempt from posing a security risk, and ones that you uploaded yourself (as opposed to ones included with a theme, for instance) will be harder to track down and replace after things are fixed again. Therefore it is usually a good idea to grab a copy of all the images in your upload folder so as to avoid broken images in posts later. If you have any non-image files that could potentially have been compromised, such as zip files, plugins, or php scripts that you were offering people, then it is a good idea to grab fresh copies of those from the original source.
3. Download a fresh version of WP, all of the plugins you need, and a clean template.
Using the WordPress automatic upgrade plugin does make it easier to upgrade every time a new version comes out. However, it only replaces WordPress specific files, and does not delete obsolete ones. It also leaves your current themes and plugins in place, as is. This means that if used to upgrade a blog that has already been compromised, it can very well leave the attackers a way back in. It is best to start over from scratch as far as the files portion of your installation goes. Note that if you use the EasyWP WordPress Installer script that I wrote it saves you from having to download, unzip, and then upload all of the core WordPress files, although you will still need to grab fresh copies of the themes and plugins that you want to use.
4. Delete all of the files and folders in the WP directory, either through FTP (slower) or through cPanel’s File Manager (faster).
Now that you have fresh copies of all the files you need, and copied all of your uploaded images, completely delete the entire directory structure your blog is in. This is the only surefire way to completely remove all possibly infected files. You can do this through FTP, but due to the way that FTP handles folder deletion (ie. it walks the directory structure, stores each and every file name that needs to be deleted, and then sends a delete command for each one), this can be slow and in some instances cause you to get disconnected due to flooding the server with FTP commands. If available it is much faster to do this through either cPanel’s File Manager, or via command line if you happen to have shell access.
5. Re-upload the new fresh copies you just grabbed.
This step should be self explanatory, but I would like to mention that if your FTP client supports it (I use FileZilla, which does) and your host allows it, then increasing the number of simultaneous connections you use to upload can greatly reduce your overall transfer time, especially on servers or ISP’s where latency is more of an issue than bandwidth. In FileZilla this setting is found by going to “Edit -> Settings -> File transfer settings”:
Also, if not using the EasyWP WordPress Installer script, don’t forget to edit and rename your wp-config.php file (when freshly unzipped this is named wp-config-sample.php).
6. Run the database upgrade (point your browser at /wp-admin/upgrade.php).
This will make any necessary changes to your database structure to support the newest version of WordPress.
7. Immediately change your admin password.
If you have more than one admin (meaning any user with editing capabilities), and cannot get the others to change their passwords right then, I would change their user levels until they can change their passwords as well. If there is anyone in your user list that has editing capabilities, and you do not recognize them, it’s probably best to just delete them altogether. If changing passwords is something you hate doing, then maybe my new memorable password generator can make that a little less stressful for you. 😀
8. Go through the posts and repair any damage in the posts themselves.
Delete any links or iframes that were inserted, and restore any lost content. Google and Yahoo’s caches are often a good source of what used to be there if anything got overwritten. The following query run against the database can help you isolate which posts you want to look at:
SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%' UNION SELECT * FROM wp_posts WHERE post_content LIKE '%<noscript%' UNION SELECT * FROM wp_posts WHERE post_content LIKE '%display:%'
If you did not change the default prefix for WordPress tables, than you can copy and paste that directly into a query window and run it, and it should pull up any posts that have been modified to hide content using any of the methods I have come across so far (iframes, noscript tags, and display:none style attributes). To get to a query window in cPanel, you would click on the MySQL® Databases icon, scroll to the bottom of the page, and then click on phpMyAdmin. Once the new window or tab opens, you would click on the database in the left hand side that your blog was in, and then in the right side at the top click on the SQL tab. Then just paste the query into the large text area and hit the Go button.
Note, however, that there may be other types of injected content that I haven’t seen yet, and that a manual inspection looking for the types of patterns that first alerted you to the fact that your blog was hacked is always a good idea.
UPDATE: 9. (still valid in 2015) If you are having issues cleaning the installation yourself
When I wrote this post back in 2008 I intended it to be a do it yourself guide for the non-techie. However, I do realize that some people would still rather a professional programmer perform many of the steps I outlined here. If anyone has had their WordPress installation hacked, and either is uncomfortable attempting to clean it on their own, or has tried to do so with no success, I am available on a case by case basis. Most cleanings can be performed in about one hour, two at the most. The time can vary depending on the size of the blog, the amount of customization to the original theme, and the number of plugins installed. Feel free to contact me here if you feel like you could benefit from my help. Please include the site and any details that you think might be relevant (pro theme, anything you may have tried on your own, etc.) in the contact form.
UPDATE #2: 10. A note on hosting.
This past year (2010) has seen multiple waves of attacks on people’s websites that happened not due to insecurities within the WordPress platform itself, as has historically been the issue, but rather due to vulnerabilities with the actual hosts. Some of the bigger names that were hit include GoDaddy, Rackspace Cloud, MediaTemple, and Network Solutions, for instance. It is very important that you use a host that is not only well versed in security, but one that is stable and has knowledgeable tech support as well.
Update #3 11/14/2012:
Please note: if you are currently hosting with either HostPapa or Netregistry and you are here because you were hacked then the following tutorial may not be sufficient. Please see this post for more details:Hosting with HostPapa or Netregistry and Hacked? Switch Hosts Now. (hacked by hacker)
My personal recommendation for shared hosting is Hostgator. It is where this blog and many other sites of mine are currently hosted. Yes, that is an aff. link, but I would recommend them even if it wasn’t. For a dedicated solution that is both affordable and robust I use The Planet, which is where I host Bad Neighborhood. Both companies are ones that I have been using for years without issues, and that I do recommend to my own clients when they find themselves dissatisfied with their current hosts. If you were hacked, and your WordPress was up to date when it happened, then a change of hosts is something you should consider looking into.
Michael, can you tell us what directory permissions you recommend for a working WordPress install? I.e. I find that people say you should not have any writable directories – but if you do that, image upload doesn’t work, etc.
In your opinion, what is the best permissions for a WP install?
Ultimate post. These points are really important and thanks for this because I am sure a small mistake will be the main cause of any kind of loss
This definately Works. I though everything was gone when my provider turned me off.
Lisa check these guys out for http://www.dotcomcatcher.com they have wordpress hosting or actually get a hosting account and install wordpress from there value application section takes about 5 min.
Being hacked is a violation – Great solution you post here.
Thanks
Thomas Geraets
oh, we had mysql injection attack, luckily it only edited index,main,home and ,js files. Took three of us 4 days to clean and another two reinspect, wish would have come across your post earlier, :-), thanks though now we know there is better way.
Thanks for this great article. I’ve had to deal with three wordpress-hacks this year, so this post helps me a lot!
Thanks for the post!! This is just what I was looking for. It happened to me last week. I will try this step by step. It makes me a little nervious, because my Data Base is full and I am afraid of loosing the information…
Getting hacked is a far too common occurence so this is a great article and very timely
It’s really a pain in the …. Been hacked several times last week. This joker somehow got access thru ftp because of a trojan and added a few lines of javascript to every index.php file it could find and any javascript file. So each and every template file was infected as was the index.php file in the root.
After I upload the new WP 3.01 and go to the upgrade link to fix the directory access I get this:
Error establishing a database connection
This either means that the username and password information in your wp-config.php file is incorrect or we can’t contact the database server at localhost. This could mean your host’s database server is down.
* Are you sure you have the correct username and password?
* Are you sure that you have typed the correct hostname?
* Are you sure that the database server is running?
If you’re unsure what these terms mean you should probably contact your host. If you still need help you can always visit the WordPress Support Forums.
is there a bad bot trap you’d recommend?
Thank you for the post. At the moment we are starting to use word press, I heard is better for search engine, and easier to use… I dont know about the search engine part, but It is definitively easier than joomla! Only for that reason is worth it, but we need to restore the information (not for hack uses) Thanks God there are people like you that take some time to share these type of information! Other wise I would be in trouble! 🙂
I have started my blog with wordpress. very useful post for the beginners like me.
Thanks once again
Thanks for the post!! This is just what I was looking for. It happened to me last week.
I would love to know more info how to prevent it in the first place
@dini – currently staying up to date with WordPress itself and having a stable, knowledgeable host seem to be the best preventative. The problem is that a new exploit might always get included in a future version, or some new way to hack the hosts themselves discovered. There really is no way to know you are 100% safe.
Thank you so much for this great post. This will save me lots of assle and funds instead of having to look for our=tsourcing options to sort the problem out when it arises. Once again thanks.
Nothing worse than a hacked WordPress installation… I remember it happened to Chris Pearson once, he got Viagra Spammed in his site links lol.
Thanks for the step by step instructions
My WordPress site was hacked. I only changed the theme and it’s working now…
tatay – Often times the part of the hack that causes the symptoms is found either in the theme, or in a combination of code in the theme and entries in the database, and changing the theme can indeed make those symptoms go away. The problem is that in the majority of the cases the hackers will just come back again through back doors that are located elsewhere in your installation, back doors that they inserted into your site when they hacked it the first time. Hopefully this is not the case with your site, but if you do get hacked again then you will want to keep this in mind. Good luck.
OMG! thanks for the info Michael. Hope the hacker will not come back.
Great info how to quickly get your site backup. I would love to know more info how to prevent it in the first place. Putting up a new site and not fixing what caused the problem will recreate the situation all over again.
Yeah very nice information but it is only basic information. A hacker played with my database. Even if i export all post using export function still i m getting the error in new installation…
@stylo – Most times the database is messed with. No clue which “the error” you are referring to though.
Hi, I just got hacked few hours ago. They completely change my main page and when I try to login using my Admin ID, password no longer accepted. I manage to go to my Control Panel and restore my backup. Very lucky it works. At the point of getting hack, I’m using version 2.8 +.
Odds are that you got hacked before a few hours ago and you only just now started to show symptoms. Simply restoring from a backup might not be enough, which is what this whole post is about. Either way, even if the backup is clean if you don’t upgrade you will simply get hacked again. WordPress 2.8 is not secure.
Personally I think a complete fresh install is the only solution. You’ll never know what files might be infected.
Michael, I was wondering, If your site is hacked and you restore it from a backup. You still don’t fix the exploit the hacker used right? How do I prevent the hacker from using the same method?
Thanks!
@Timothy – well, that’s what this post is about… not restoring from a backup but reinstalling altogether.
chek my web site
You are right, according to Google you are definitely hacked. Your site does not appear to be WordPress, however, so this article really wouldn’t help you much. I am not sure what exactly it was you were hit with, but you should hire a programmer to go clean it up for you.
Hai….my site has been hacked. I already install with new fress wordpress. But why the hacking website still appear on my website?? and another website I had, I already install with new one, but now there is a problem with the wordpress I think. Because the wordpress themes didn’t appear completely. I try to install with another template, unfortunately the template doesn’t look the same. How can this be happen? Please help me…I’m nearly desperate with this one. thanks
The people who hack into peoples online businesses and do this sh*t need to get a better hobby.
Great info on how to get your site back working quickly. More info how to prevent it in the first place would be appreciated. Putting up a new site would be a major poin in the freckle.
I got hit last year in the mass Godaddy hack. I have two accounts there, one on a shared server and one on a private IP. The shared one got hacked, which meant I had to do this cleansing process to about a dozen sites 🙁
Arrghh. They got me this weekend. This looks like just the thing I need. A bit beyond me but my friend is going to walk me through it. Thanks for posting it – I appreciate your efforts. Cheers Debs
I dont wish it to anybody since I have experienced it myself but that was a neglected error. If I was keeping my plugins up to date that would never happen.