My site’s .htaccess file hacked, how?

  • Hi all,

    I was wondering if someone could provide knowledge on how an .htaccess file is hacked in a wordpress blog.

    This morning, I found a 500 Internal Server Error when trying to launch my blog’s default page in a browser. I did a preliminary google search for this and saw content related to .htaccess files being changed. Sure enough, mine was. It didn’t really look like there were any redirects, but it was definitely different.

    I’ve done a lot of research since then and it seems that there are ways bots or viruses can obtain FTP information to enable a user to alter the .htaccess file to bring an entire blog/site down.

    I also see that the Codex directs users to set permissions to “777” to enable pretty permalinks which are better crawled by search engines.

    Should I continue to have “777” permissions applied to my .htaccess file? Is this how an intruder got in to alter my .htaccess file?
    I see that there are many alterations you can make to the code inside of an .htaccess file. If the permissions are not too open, will these code changes even matter?

    As of yet, I have changed the .htaccess file back to what it was previously and my blog works fine. I don’t see any other alterations to the blog that look out of the ordinary.

    I’m just trying to obtain some knowledge on protecting .htaccess.

    Any help or advice would be greatly appreciated.

    Thanks in advance.
    Sincerely,
    Dick

Viewing 2 replies - 16 through 17 (of 17 total)
  • PipSqueak

    (@pipsqueak)

    I am having the same problem. I’ve asked my host and they said no one accessed my server to modify my htaccess on the modification date. So they suspect it’s one of the plugins that are doing that. I have a feeling it’s caused by the “redirection” plugin, are any of you having the same plugin?

    france1972

    (@france1972)

    protect your htaccess by adding this to the htaccess itself:
    # protect .htaccess
    <Files .htaccess>
    Order allow,deny
    Deny from all
    </Files>
    apart from this it may happen that your htaccess gets hacked. Be sure, like other people said to give your file the 644 permission. Try some trick to protect your blog like these ones

Viewing 2 replies - 16 through 17 (of 17 total)
  • The topic ‘My site’s .htaccess file hacked, how?’ is closed to new replies.