My site has been hacked a few times in the last couple of months.I am keeping it updated.
Wordfence has picked up the following hack. Even though it says that it’s not a core plugin from wordpress, as soon as i delete it, my site stops working and posting an error message. Someone on Wordfence has told me that it is in the Must Use files. And I sould get a fresh copy Is this file from you?
Filename: wp-content/mu-plugins/gd-lib.php
File Type: Not a core, theme, or plugin file from wordpress.org.
Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: fwrite($hdl, “<?php\n$mtchs[1]\n?>”);\x0d\x0afclose($hdl);\x0d\x0ainclude(“{$eb}.$algo”);. The infection type is: A Backdoor known as gogo.enen.
You may find this useful:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/
