bigfishweb

Yes, the HTML files were planted in the public root dir and the php files were in many different wp folders in wp-content not so much in the admin part. I had one php file that was getting hit many times a second driving my bandwidth up to 100gb a day. I got shut off from the host and it wasn’t fun. Explain that one to a client. ?? Let me know if you have any more questions…

Yes, the issue was malware that was installed through a form on the site somehow. It installs tons of html files and php files in the directories of the site, if you don’t kill them all it will keep reproducing the issue. It also creates a malware table in the WordPress DB. Unfortunately our solution was to completely rebuild the site, change all the passwords (FTP, WordPress, and DB). Change the config.php page to use different salt keys and completely wipe the entire directory and reload a fresh copy of wordpress and build from the ground up. Our failure to update plugins when updates came out, and the Revolution Slider had another plugin that patched a vulnerability we didn’t know of. It was a completely bad situation. If only I had backed up the entire site before it got infected. It taught me a valuable lesson about WordPress. Keeping things up to date always, never use over complicated plugins like woocommerce and custom build as much as i can on my own so it can’t be hacked. Also, if you buy a theme make sure its from a developer that is constantly updating it to work with the latest version of WordPress. I wish it was easier but I spent hours working with the host on the .htaccess file and it always changed until I rebuilt the site. I also looked at the logs and blocked all IP addresses that were not in the US or Canada. Its a huge .htaccess file but since the site is for a furniture store I don’t think we need to worry about someone overseas visiting the site. And now we have been issue free since.

This is very thorough Lee. I appreciate it. I will give all this a try. I am just wondering if it is easier to simply upload a fresh copy of wordpress, transfer the uploads directory and the plugins directory, plus the config.php file and see if this fixes it? Are there other folders/files or files that I would have to transfer in order to make this seamless?

Thanks for the links. I installed this and tried activating the secure.htaccess file but the issue is, I delete my current .htaccess file in the root dir, then activate the bullet proof htaccess file. Then when I visit the main site the .htaccess still reverts back to the old .htaccess file? I even tried disabling the theme and changed it to twenty thirteen then updated the .htaccess file then hit the website again. And guess what. the .htaccess file reverted back to the original wordpress code. So what files can update an .htaccess file from the core? I know updating permalinks can change the htaccess file is there anything else?

The site was hacked back in April, I think there are still files I need to find and delete. Lots of php files in the uploads directorys. I’ll let you know once I have a clean wordpress directory.

Tried the 0404 after setting it. It still reverts back. I haven’t tried changing the theme yet. I have tried shutting off all plugins and turning them on one by one. Maybe it is the theme? Do I need to worry if I do shut off the theme? WIll it turn back on correctly or does it stand a chance for corruption somehow. It’s a custom theme that was purchased and highly customized. I just don’t want to swap out the theme and then re-activate it to find that I need to restore parts of it etc…

Yes, thats what I have but it seems whenever the wordpress site is hit (any page) the .htaccess file is overwritten to the basic worpress code as you have above with permissions set to 444. I checked all the plugins, disabled everything to the bare bones and it still overwrites the .htaccess file. Something real strange going on. I am using WordPress 4.2.4

So you are saying any extra htaccess code like hot linking or ip address deny should be in the # wordpress comments #?

This is happening to me too. I am on a shared hosting service. If I change the .htaccess file in any way either through cPanel then hit the web site the .htaccess gets written back to the basic wordpress .htaccess code and it writes it back to a date a few months ago. What is going on here?

Strange because when I tested it, I tested it on both safari and firefox and firefox worked . That tells me my plugins would be fine? I uninstalled it for now. When I can re-install I’ll let you know…

Thanks for chasing this down…

Anytime! I was psyched when I finally found a plugin that already did this. Rather than me creating one from scratch. The beauty of plugins…

Thank you for the response… Looking forward to the fix!

Maybe it broke in 3.5.1 because I do not see the table in the admin panel.

Simply delete your cookies for the site, and it clears it up…

Regards