Request a Website Audit to Get Your Marketing on the Right Track! Get Started ->

Web Savvy Marketing

We are web designers, SEO consultants, bloggers, social media enthusiasts, and WordPress experts all rolled up into one.

  • Home
  • Our Agency
    • Industries We Serve
    • Sample Client List
    • Testimonials
    • Charitable Contributions
    • Events and Community Involvement
  • Website Design
  • SEO Consulting
  • Blog
    • Search Engine Optimization Articles
    • Website Development Articles
    • WordPress Articles
  • Contact

07.28.11 WordPress

The Case of the Hacked WordPress Website

Broken Glass

A few months ago I was out of town visiting a client. On my route home my faithful iPhone popped up an email from another client. The client said “something strange” was appearing on their website. Peculiar I thought, because I’m the only one with admin access and I haven’t changed anything. I thought an investigation was in order, but didn’t go much past that initial thought.

Following the Clues

When I could get my hands on my Mac, I checked out the website. Sure enough, there was bizarre language or code across the header. It referenced the WP e-Commerce plugin. At first I thought the plugin broke, but was not sure how it happened or even why it happened. I checked out the website for unknown client changes and nothing seemed out of order. I soon called my trusted WordPress consulting peep Chris and he was also perplexed. We both we dug around, although I’ll admit, he dug much farther in the PHP files than my newbie self could.

The events are now somewhat fuzzy, because the three days of chaos run together in my head. Chris, the king of PHP and CSS, dug deep into code while I searched Google. I don’t know PHP very well, but I can match Chris’ PHP skills with my search capabilities. Of course, Google being the search engine I love, headed us down the right path. With my minor search help and Chris’ expertise, we solved the mystery. But not before Chris fixed the website three times.

Locating the Nasty Villain

Each time Chris fixed the website, it broke. He knew something was hidden deep and I knew he would find it, which he did. After Chris found the nasty beast hidden within our code, I wanted to scream. A month before this all occurred I had hired a consultant I found through the WP e-Commerce plugin website. He was on their list of preferred developers. I needed a little help customizing this plugin and he appeared to be a reputable consultant. He had installed a plugin called WP-phpMyAdmin. He didn’t tell me he had done so, and like a trusting idiot, I didn’t check. He left the plugin active when his code changes were complete and went merrily on his way.

Well, that my friend, was the villain. And the villain was ugly.

WordPress Hacking Code

Malware Notice on Sucuri

That code was a backdoor and that backdoor not only corrupted my client’s website, it costs me a lot of time, money, and it made me very angry. For the record, it takes a lot to make me angry.

The plugin has been removed from the WordPress plugin repository and Sucuri (a company of hacking pros) posted a blog post about this nasty plugin in late June. Sucuri was also the company I used to validate the hacking and to double check that we had indeed gotten rid of the villain.

Protecting Against the WordPress Villains

How can you protect against such events happening to your website or blog? Similar to that of your children, you can put safety protocols into place and you can try and baby proof your house, but you can never completely protect them. But you do try and you stay vigilant.

My recommendations for keeping your WordPress website safe:

  1. Keep Your Software Up to Date – Always make sure your WordPress core and plugins are up to date. Don’t fall behind on release versions. If you don’t know who to update WordPress, then ask a professional who offers WordPress support and maintenance to help. Please note this process is more than just clicking a button.
  2. Keep Strangers Out of Your Code – I thought I had done this, since I did locate the consultant off the plugin developers’ website. I had even reviewed him online and spoke with him a number of times. But quite frankly, he isn’t Chris, my long-term WP peep who I know I can trust.
  3. Keep a Clean House – Deactivate and delete any plugins that are not used. That way you won’t have to worry about updating them.
  4. Keep a Back Up – I had a complete backup of my client’s website and this was great for us. We could bring over clean files and we could double check data where and when needed.
  5. Keep a Guru on Call – My clients keep me on retainer and I keep people like Chris close. I have my strengths, but I can’t be the superwoman of all things internet. You have to have a core set of resources or team members who can back you up when things go crazy.

Thanking Your Ultra Cool Clients

When my client’s website was hacked, she remained calm. Her only comment to me was “Rebecca you seem hassled” and then she made mention of good weather in Michigan and said everything was good. God bless Deborah and her wisdom. As Chris and I were losing it, she was calm. She knew I was working on the issue and she let me be. She never yelled, scolded, or did anything to make the situation worse. For that I was so very thankful.

You could not ask for a better client than Deborah and you could not ask for a better WordPress peep than Chris. I have been blessed with both. I’ve known “virtual Chris” for years and “physical Deborah” entered my life this year. Chris and I work closely together and Deborah is moving onto website two and three with me. I am thankful to have and to keep both.

Tags: WordPress, WordPress Plugins

Like this article?

Sign up and receive weekly updates via email. Don't worry, we value your privacy and we hate spam just as much as you do.

  • This field is for validation purposes and should be left unchanged.

Rebecca Gill's avatar

Rebecca Gill

Rebecca is the founder and president of Web Savvy Marketing, a Michigan digital marketing agency. She has a well-rounded business background within SMB and enterprise organizations, as well as over fifteen years of experience in sales and online marketing. She provides SEO consulting services for clients, SEO coaching on Clarity.fm, teaches SEO at diySEOcourses.com, and has a weekly podcast at SEObits.fm. Learn more at RebeccaGill.com.

Request a Website Audit

Did you try a DIY website audit checklist, only to find you missed the important items that would truly influence your SEO, traffic, and revenue? What you really need is a professional website audit to keep your website and SEO healthy.Request Your Audit

Browse the Blog by Category

  • Branding (8)
  • Community Involvement (37)
  • Content Marketing (11)
  • Internet Marketing (60)
  • Search Engine Optimization (93)
  • Social Media (24)
  • Website Development (59)
  • WordPress (92)

The Beginner’s Guide to Search Engine Optimization

Learn what SEO is and why it matters to your website or blog. Download the free eBook and start your SEO journey.Download the eBook

Let's Create Something Together

We'd love to help you create something amazing.
Reach out to us and tell us about your vision.Say Hello

Full-Service Digital Marketing Agency

TwitterYoutubeFacebookLinkedinGoogle +

About Us

  • Our Digital Marketing Agency
  • Industries We Serve
  • Client Testimonials
  • Community Events
  • Charitable Contributions

Design and SEO Services

  • Logo Design
  • Website Design
  • Custom WordPress Themes
  • PSD to Genesis
  • SEO Consulting

WordPress Services

  • WordPress Customizations
  • Support and Maintenance
  • WordPress Upgrades
  • WordPress Migrations
  • WordPress Training
Made With Love in Michigan | Copyright © 2009 - 2022 Web Savvy Marketing | All Rights Reserved
  • Privacy Policy
  • Affiliate Disclosure
  • Sitemap