Hacked Wordpress site

[ddrueding]

I've been given a role in cleaning up a hacked webpage that was running an old version of wordpress. Cleaned it up, updated to the newest version, but it is still getting vandalized about once a day.

Other than changing all the passwords to accounts, what else should I be doing?

 

[Mercutio]

Are they attacking Wordpress or php or MySQL?

 

[Mercutio]

Also, do you control the whole machine or are you just dealing with an account on a hosting provider's server?

 

[ddrueding]

Are they attacking Wordpress or php or MySQL?

Yeah, no idea. I'm not a web guy at all. The company has a friend who is doing some repairs, updates, and restoring backups when it gets hit. But I don't think they are up to doing anything beyond that.

Also, do you control the whole machine or are you just dealing with an account on a hosting provider's server?

It's hosted. I'm not even sure where yet. I just got the call when I posted here, I don't even have an account myself at this point.

I'm fairly certain I'll need to bring someone in for this, but would like to know a bit more before recommending any action.

 

[timwhit]

Here's a good starting point: http://codex.wordpress.org/Hardening_WordPress

I would pay special attention to the file permissions section.

 

[ddrueding]

Thanks for that. I'll be reading up.