Solved

your opinion about this .htaccess file?

Posted on 2013-12-20
8
338 Views
Last Modified: 2013-12-30
Hi friends. I have a WordPress site that was compromised. Last night, someone made changes in the web site --disabling security plugins.

I am reviewing changed files. Here is the .htaccess file; what do you think of it? Does this look like nefarious code? Please give me your thoughts and wisdom, if you have time. Thank you as always.

Eric

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Open in new window

0
Comment
Question by:Eric Bourland
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 29

Accepted Solution

by:
Randy Downs earned 500 total points
ID: 39732677
Looks like the standard file for perma links

http://wordpress.org/support/topic/i-destroyed-my-site-default-htaccess

ere is a very basic htaccess file using "pretty permalinks"

# BEGIN WordPress

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
0
 
LVL 3

Author Closing Comment

by:Eric Bourland
ID: 39732722
Very reassuring. Thank you very much, and happy holiday!

Eric
0
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 39732769
Of course, you still don't know how they got in and what other code has been messed with.  So I wouldn't be all that reassured :)
0
Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

 
LVL 3

Author Comment

by:Eric Bourland
ID: 39732785
I know. I have inherited a big mess. I might be back. =)

Peace.

Eric
0
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 39733018
Merry Christmas!

All kidding aside, run a free Sucuri scan on the site and see if it picks up a modified file.  If you find yourself doing this semi-often consider a subscription to Sucuri where they go in and clean it for you or StopTheHacker (similar service).
0
 
LVL 3

Author Comment

by:Eric Bourland
ID: 39746483
Jason,

I hope your holidays are treating you with peace and other good things.

Good advice about Sucuri. I still have a hacked site I am trying to unhack and secure. In the process I am learning a ton about WordPress. =)

I am curious to know how Sucuri or StopTheHacker can find all affected files -- they are .js files I think, but I also think that if these nefarious .js files are removed, they regenerate themselves. It would be so helpful to know just what Sucuri et al. does to remedy that.

I will run all of this past the client and see what he wants to do. A Sucuri investigation and report might be what I need to see next.

I have another WordPress question I will post here in a little while, after scratching my head about it for a few days.

Hope you are well.

Eric
0
 
LVL 70

Expert Comment

by:Jason C. Levine
ID: 39746938
I am curious to know how Sucuri or StopTheHacker can find all affected files -- they are .js files I think, but I also think that if these nefarious .js files are removed, they regenerate themselves. It would be so helpful to know just what Sucuri et al. does to remedy that.

Sucuri and StopTheHacker both offer two levels of service.  The basic level is the free site scans which simply sends a robot to access the page you tell them to access and analyzes the code returned by your server.  So if there is malicious code present in the JS files or the rendered HTML, the robot sees it and should be able to tell you which file is currently compromised which is helpful but doesn't help you fix it.

The true value is the paid service.  You usually have to give them SSH or SFTP access to your server but they will then go in and scan all WordPress files and look for files with different checksums than what is expected from normal.  Since almost every file in the WordPress core (except for themes and plugins, really) don't change after installation, the checksums can be used to determine if a file has been modified.  If so, you look at the file for injected code and from there identifying the malware and removing it is pretty simple.  Sucuri and StopTheHacker can also change the files and server settings to remove common WordPress security holes that allow for malware to be inserted.  Sucuri also offers a plugin that works as both a file change log and IP blacklister which is kind of nice.  Not sure if StopTheHacker has a similar function.

If the client can afford it, a better option than Sucuri or StopTheHacker is the higher levels of service from VaultPress.  VaultPress backs up your entire WordPress site, files and database both, and also provides a complete log of changes made to files and databases.  If you pay for the second tier or higher of the service, they will alert you to malware infections and let you instantly roll back to a known, good state.
0
 
LVL 3

Author Comment

by:Eric Bourland
ID: 39747214
Jason, thank you as always. Very useful information. I will discuss this with the client.

Hope you're great.

All best,

Eric
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Who says nothing in life is free? WordPress.com is a freebie. WordPress.org's downloadable publishing platform is free. Heck, even WordPressMU is free. WordPress is an open source project, which means it can be used on any personal or commerc…
WordPress can be pretty daunting, especially for a beginner, so I thought it might be a good idea to write an article to show how easy it is to get started in WordPress and to design a custom theme.  The first step is to check with your hosting comp…
This video teaches viewers how to create their own website using cPanel and Wordpress. Tutorial walks users through how to set up their own domain name from tools like Domain Registrar, Hosting Account, and Wordpress. More specifically, the order in…
The purpose of this video is to demonstrate how to prevent comment spam on a WordPress Website. This will be demonstrated using a Windows 8 PC. Plugin Akismet will be used. Go to your WordPress login page. This will look like the following: myw…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question