Hello dear visitors of my site, I hope you are well.
I meet you today in a somewhat different post.. This is definitely a different experience..
Several days ago I noticed strange behavior on one of the sites I manage. At first I thought it was a simple WordPress issue.
But I noticed that there are many files placed in the home directory, and then I found that some pages were redirected, and there were codes injected into the home directory.
The site was working normally, and there was no indication of a problem. Only when entering the control panel did you discover the real problem there.
All pages in the control panel were giving a 404 error, you cannot install anything in wordpress. I discovered that there had been a change in the .htaccess file?, when I tried to modify it, it was changing at a tremendous speed… Here I realized that the problem was very big, and that the hack was at the server or account level.
At first, I used a server antivirus to clean the affected files, and minimize the problem as much as possible.
After cleaning I was able to modify the .htaccess file and then removed the files that were placed in the home directory.
Of course, the problem did not end, because whoever was able to put all these codes and files, certainly has gone further than that..
I contacted technical support, and they analyzed the entire server, and they informed me that the server had been hacked at the root level, and there was no way to solve the problem, to move the sites to another server, and reinstall the system completely.
Indeed, the sites have been safely transferred to another server. Thank God the problem ended after a week of work.
In fact, I did not expect something like this to happen to me. I was reading that all public servers are vulnerable to some form of hacking, and they cannot be 100% secured. I always say that I have a small and unimportant server, and I don't think anyone would think of hacking it.
But this is what happened, and it seems that the server has been exploited to direct denial of service attacks, and to send annoying messages to other sites.
The files were not damaged, nor were the databases, nor were the other sites hacked.
Thank God the problem is over. I may not have enough experience managing servers, but I learned a lot, and I'm still learning from my experiences and failures.
Leave a Reply