Site Blacklisted

[loopyal]

Hello Jo.

Do you know exactly how they got in?

If not, here is one possibility:

Check to see if you have a copy of timthumb.php

If you do, and it is an old version, it has a vulnerability you must fix, otherwise it will happen again.

Here is information about that, including a scanner that should find and fix that problem.

<cite>wordpress.org/extend/plugins/timthumb-vulnerability-scanner/</cite>

[Bondara]

I think you have already done quite a bit.

I suppose just be a little more selective which plugins you install, some have holes in and once the word is out about particular holes in certain plugins these people will come looking for blogs with it installed.

[Bondara]

Agree

[littlesthobo]

Thanks all for your responses, much appreciated.

I installed the timthumb vulnerability scanner and it says no instances were found.

I'm going to go through and ditch the unnecessary plugins...I use woocommerce and they have  recent upgrade but its not compatible with my theme so I can't update it, which is a giant pain.  I hope its not that.

Thanks for your help.

[Bondara]

I just want to reiterate what Andy said about sitespeed as well, try to have as little plugins as possible.

When you visit a WP site and its super slow, its usually because they have gallery plugins and all sorts running which sucks the life out of the sitespeed.

Anyway, good luck seems as though you know what your doing anyway.

[littlesthobo]

Thanks, I'm not so sure!  I'm a freelancer and I wok on my own so I have nobody to really bounce ideas off, so this community is great for that.  Glad to know I'm doing it right

I'm not a bit lover of plugins and I try to keep to a minimum, but I've removed anything unessential - even my beloved Flare sharing buttons, for now anyway.

I'll let you know when Google come back to me

[loopyal]

Jo,

before you removed the bad files, did you check the dates?

If you have logs, you could go back to see when those files were first accessed.

Then go backwards looking for activity that doesn't look normal.

That could tell you where the problem is.

[littlesthobo]

I didn't check the dates  The site is less than a month old though.

When you say logs, I'm not entirely sure what I'm looking for.  I use cpanel so have access to various logs, but I have to admit, I haven't spent any time in there and now I'm conscious that this is something I need to educate myself on quick.

Any suggested resources for which logs to use for what?

[loopyal]

The webserver log is what you need.

You may be able to see that in Cpanel, depending on how it is configured.

The log may also be in the document root, updated daily and compressed.

If you haven't looked at logs before, it can be difficult to determine what is really going on in there.

[littlesthobo]

Thanks all for your help, I was de-blacklisted this afternoon - phew.

[loopyal]

That is good to hear, Jo.

Thanks for letting us know. feedback is good.

Be vigilant, because the hackers never stop.

My dedicated server constantly has hackers trying to break in, mostly chinese and russians. Complex passwords and countermeasures keep us safe, but it only takes one weak link somewhere to break it all down.