Malicious Malware: Will You Be The Next Target?
By Allen Taylor
This past week, WordPress released version 2.8.3 of the most popular blogging platform in the world. Sadly, many of you won’t update your blogs to the latest version. Even more sad, too many of you are still on older versions of WordPress predating 2.5. One client on mine who was recently hacked was on version 2.3.3. A blog of my own was still on WordPress 2.7.1 and it was hacked. Boy, it was a nasty hack too.
Hackers can wreak havoc on a blog in a number of ways. One of the worst ways is to install a script in the code that reproduces itself and redirects your site visitors to a site where they can download malicious malware. This hurts you in a number of ways.
- If your site visitors end up on a site you don’t recommend and download a harmful program, they may lose trust in you and never return to your site
- If your site is off line for an extended period of time while you clean up the code then you could lose valuable readers and revenue
- Your own computer may be redirected and download malicious malware when you go to log in to your blog to make a post
- If site visitors tell their friends that they downloaded malware from your site then you’ll lose future readers as well.
How I Discovered A Top Ranking Site I Own Is Distributing Malicious Malware To My Site Visitors
My blog has the No. 1 ranking in Google for its niche key term. That makes it a pretty popular blog within its niche. And WordPress 2.7.1 isn’t that old of a version of WordPress. Still, it got hacked. Here’s how I found out:
I went to login to make a post and landed instead on the home page of my blog with a big red box taking the place of the content. The words, big and bold, at the top of the page read “Reported Attack Site!” My site was effectively taken down by Google in order to prevent me and my site visitors from being affected by malicious malware. Meanwhile, I logged in to Google Webmaster Tools and ran a diagnostic on the site to find that there were a couple of dozens of pages infected with malicious malware. Google listed the pages. Now it’s clean up time.
How Hackers Get In
Hackers look for weaknesses they can exploit in a blog or website, usually a CMS. An old and outdated version is such a weakness. Also, weak passwords such as one word passwords that are easy to guess can be a late night snack for a hacker looking to do some damage. A combination of these two very common weaknesses can be an open door invitation.
If you are on any version of WordPress other than WordPress 2.8.3 then I urge you to upgrade immediately. At the same time, you should change your passwords to make them stronger. Security experts recommend that you use lower case and capital letters, at least two numerals and two special characters, and to make your password long. At least 8 characters, but 10 or 12 is better.
Your password should be something similar to this – Ot#3Y@p9 (just an example, not a real password).
What To Do If Your Site Is The Target Of Malicious Malware Pushers
If you find yourself a target of malicious malware and your site is considered an attack site by Google – a common occurrence for sites that are hacked and malicious code installed against the owner’s wishes – then you need to clean up your site code immediately, before you lose your rankings and your loyal readers.
The first order of business is to back up your site and remove all files from the server. Next, install the latest version of your software immediately and make sure you include a fresh copy of your Config file. You should also re-install your theme, but don’t use the same one you backed up. Use the original file and upload it to your server. That alone should be enough for most sites to be restored, but if a hacker has installed scripts and source code in your database files then you’ll need to go into your cpanel and clean up the code. That will require a developer or someone who is familiar with code cleanup.
It’s not as expensive as you would think it would be to perform a code cleanup and remove any malicious malware, but it’s an expense that you can avoid. You’ll get off cheaper by upgrading your software so if you are not on the latest version of WordPress – WordPress 2.8.3 – then I’d urge you to make sure you get that done today. If you are currently a customer of ours, call today for a free upgrade to your WordPress. That offer is good through the month of August.
Allen Taylor manages blogs for a list of clients in a variety of industries and niches. He writes Taylor’s Internet Marketing Blog and owns several websites in more than one niche. He is a full-time marketer and ghostwriter. 717-528-4005.
This article courtesy of SiteProNews.com