Our site http://www.news4masses.com is getting hacked again and again, despite having changed all passwords etc. Can someone suggest any fix for this or Newspaper Team has any recommendation for any security plugin etc to avoid this.
Thanks in advance
I’m no expert, but do you have Login/Register enabled? Might want to suspend that if so so ppl can’t login or do brute force attack.
install wordfence pulgin and scan for backdoor or php shell src
Good ideas for basic security:
a) do not use admin as the superuser login name; always make second name; don’t use the superuser admin name to build pages as it reveals that ‘user’ to hackers;
>> ‘superuser’ for site admin
>> ‘othername’ for content building as admin; not superuser level
b) use plugins like ‘limit login attempts’
c) disable xmlrpc – known attack vector; disable editing of WP files from the WP admin
d) force https
e) force strong passwords (not ‘bunny72’ but ‘8g932vygSD97j$’); disable password reset functions
f) remove all old-unused plugins, themes no longer used – nulled code can still be used by hackers
g) scan site regularly with securi free scanner
h) make sure using good host running modern versions of bind, mysql, php, etc. — make sure running php 5.6 and up as older versions are ‘end of life’
i) make sure running WP 4.8 and up
j) make sure web host running IPtables and automatic Ip blocking for hack attempts
k) fully implement suggestions from the WordPress documentation (always good to learn to use WP by reading the manual …. I know! Crazy, right?): https://codex.wordpress.org/Hardening_WordPress
l) make regular backups (ironically, I am doing that ‘right now’ on my machine while having first cup of coffee …)
After hack; change all passwords (hosting, FTP, and WP); delete WP, all plugins, themes, check for malicious code in htaccess, random weird php files; reinstall everything for clean copies.
