Here are the basic steps you can take to clean your account and
restore security in order to stop this from happening again:
SCRIPT
VULNERABILITIES
The most commonly used method that we see used to compromise
a hosting account is vulnerabilities in scripts,
on the account. This is especially true with popular scripts such as Wordpress,
Drupal, and/or most other popular shopping cart scripts or other Content
Management Systems.
First, ensure that
all scripts are updated to and running the latest version. Popular scripts
are especially notorious for being hacked since so many sites use them. Old
versions of scripts will sometimes have security vulnerabilities that have been
patched by a new release. Remember:
this includes any addons, plugins, or modules for a script!
Be sure that everything is running the latest version and is
secure. Always research before
installing any 3rd party addon or module! If someone else has had a problem
with what you are looking for, they will usually post about it online.
VIRUSES/MALWARE/ADWARE
The second most common method we see to compromise an
account is the use of malicious files on
the computers that have access to the account. Many types of
virus/malware/adware will look for hosting accounts and passwords to send to
attackers.
The second step is to
scan all computers that you use to access to your hosting account (cPanel, FTP,
and E-Mail) for malware and viruses!
After a full virus scan, I would highly recommend scanning
again with the free version of Malwarebytes Anti-Malware which is a great
application for cleaning malware and adware.
HOSTED FILES
Third, after your computer is virus/malware free and your
scripts are up to date, be sure to check
EVERY FILE THAT YOU ARE HOSTING! This may be tedious, but if the attacker
has left a vulnerable file on your account, they can use it to gain access to
your account in the future even after you change your passwords.
Be sure that all the
files on your account have the correct permissions, and make sure that you
are not giving too much permission that might pose security vulnerabilities.
You can set permissions using FTP or in cPanel > File
Manager. 777 or “full permissions” should NEVER be used for files and/or
directories, even when specified by installation instructions. Anytime that it
is instructed to set the permissions to 777, 755 should be used instead.
Directories should be set to 755 permissions. PHP files should be set to 644
permissions or you can use the lowest permission that allows the script to work.
Any files that contain MySQL database or other login
details, or configuration files should be set to 400 permissions so they are
only readable by the account owner.
CHANGE YOUR PASSWORDS
CHANGE ALL YOUR
ACCOUNT PASSWORDS TO HIGHLY SECURE PASSWORDS to cut off attacker access. You
should change your main account (cPanel) password, all CMS admin passwords
(i.e. WordPress), all email account passwords, and all custom FTP account
passwords. We also recommend updating your database passwords.
Without changing ALL those listed, the attacker may still
have partial access to the account, which could allow them to get in enough to
check for other vulnerabilities, or gather personal information until they can
gain full access again.
A large number of exploits we see are due to the use of weak
passwords and are easily preventable. Passwords should never be based on common
or "dictionary" words as these are easily guessed or cracked by such
means as a brute force attack. Also, be extremely careful with whom you trust
your password to! Be sure that anyone who has access to your account also knows
to use secure scripts, and has a malware and virus free computer. cPanel has an
excellent password generator, or you can use generators like the one found here
to create a highly secure password: https://secure.pctools.com/guides/password/
You should change
your account passwords AFTER securing your computer, account files, and scripts!
This is because if a vulnerability remains in one of these places, it can be exploited
and will simply continue to use your account and possibly get your new
password.
CAN YOU SCAN MY
ACCOUNT FOR HACKED/MALICIOUS FILES?
Technical Support can run a basic scan that can help them
analyze and identify hacked/compromised/malicious files on your account.
Please be aware that, depending on the size of your account,
this process can take 12+ hours to complete.
Click Here to submit a ticket to Technical Support.ADDITIONAL RESOURCES
Compromised WordPress Resources
Compromised Joomla Resources
Google's Cleaning Your Site Guide:
http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=163634
Removing Malware From Your Site:
http://knol.google.com/k/riona-macnamara/removing-malware-from-your-site/2vl8me364idq/1#
StopBadware's Information for Website Owners:
http://www.stopbadware.org/home/webmasters
