Important Security Alert and DDoS Attack for WordPress Sites

Hello Dear friends,

I am shearing an important security alert regarding serious hacking activity/DDoS attack on CMS such as WORDPRESS, JOOMLA etc. installed sites especially on WordPress sites. There is a serious attack on WordPress sites where a hacker harvesting ADMIN password and uploads malicious files under the domain and via that domain they can easily hack all other domains which are presented under your account. Hence we advise you to strictly follow the below security mechanisms in order to avoid hack issues.

As this is a very serious issue, we advise you to change the ADMINISTRATOR PASSWORD of every CMS site immediately in order to avoid the hacking issues.

The hack can happen due to the below reasons,

1. If you are having Weak admin panel or cpanel password then there is a chance for hackers to access your domain and upload malicious files
2. If you are using any upload function without file type restriction in your coding where hackers can upload suspicious files and they can rename and then execute those files easily
3. If your local system is not secured then there is a chance for getting easy access to your panel
4. Vulnerable plugins or themes will also allow remote users to upload suspicious files
5. Files and folders with 777 permission can be accessible by anyone where there is a possibility for such malicious file coding injection

To Protect WordPress websites:

Please note that in order to secure the WordPress websites we request you to do the following steps.

1. Give the file permission of wp-config.php as 400
2. Change the WordPress admin login details [ wp-admin - login details to touch password HY^2&*mKMNG87(& ]
3. To avoid WordPress login failure, you can put a .htaccess rule by mentioning to access the WordPress admin login details from the particular IP
4. In order to avoid WordPress hack, you can also install the plugin name called Wordfence [ Wordfence: WordPress Security Plugin ]
5. We advise you to not to use the admin username as "admin". Use some other toughest username and password.
6. Upgrade the WordPress version to the latest one as well as the plugins
7. Always see plugins which are recommended by WordPress and which is used by 1000's of other users

You can also refer the below link for your reference

https://wordpress.org/plugins/wordfence/
https://wordpress.org/plugins/better-wp-security/

We also advise you to do the following immediately for other open source CMS,

1. Upgrade your open source cms such as joomla, WordPress, whmcs, drupal etc. to latest version
2. Remove unnecessary installations of joomla, WordPress, whmcs, drupal etc.
3. Remove or upgrade vulnerable versions of plugins, themes, templates used in WordPress, joomla, whmcs, drupal etc.
4. Check the file and folder permissions. See whether they are 644 for files and 755 for folders. If not, change them.
5. Reset your administrator password for joomla, WordPress, drupal, whmcs etc.
6. Reset your cPanel and database login details.
7. Always use tough passwords like 3r48d*#R#T&3023r
8. Keep a backup of your domain in your local system for safety purpose

You can also refer the concern CMS forums for various security tips.

To protect sites from DDoS attack:

1. Change admin username and Use Email ID instead of using simple username to login
2. Rename login URL to secure your WordPress website using iThemes Security Plugin (formerly Better WP Security)
3. Strengthen WordPress Login Passwords
4. Automatically log idle users out of your site
5. Secure WordPress Website through admin dashboard
6. Protect wp-admin directory
7. Use cloudflare to protect the sites from DDoS attack
8. Monitor all files often which are presented under the domains
9. Secure your WordPress website through the database
10. Change the WordPress database table prefix
11. Make backups regularly to secure your WordPress website
12. Set strong passwords for your database
13. Set up a website lockdown feature and ban users
14. Use two-factor authentication for WordPress security
15. Monitor access Logs properly
16. Protect wp-config.php file
17. Disallow file editing privilege by others
18. Set directory permissions properly
19. Disable directory listing with .htaccess
20. Secure WordPress website through proper themes and plugins
21. Update themes and plugins regularly for WordPress security
22. Remove WordPress version number in your coding

You can follow above given rules / instructions for prevent your website hack from hackers.