We’ve helped two clients deal with hacked WordPress sites this week. We won’t say who they were, but they both had fairly nasty infections which meant that when visitors accessed their sites, new browser tabs would open with spammy content. In one instance, the content in question included an audio element and a persistent pop-up that was tricky to close without completely closing the browser. These were not sites we built or hosted, so it was interesting to see what the issues were and I thought it would be good to share.
The sites had some risk factors in common:
- The use of off-the-shelf WordPress themes which had not been updated
- Out-of-date plugins
- Weak admin passwords
- No firewall installed
- No additional ‘hardening’ measures in place
WordPress is great, and now generates strong passwords by default (it didn’t used to); but failing to keep things updated (especially the WordPress core and themes) is asking for trouble – and the longer updates are left, the greater the risk. That’s why we harden every WordPress website we build, and handle maintenance for most of our clients, to keep things up-to-date and minimise risk.
In the case of these two hacked sites we managed to get them both repaired and hardened in less than an hour each, so if you know what to look for, a hacked WordPress site doesn’t have to be a big deal.
This repair service is available to everyone via our dedicated WordPress rescue service WPRescue.