5 ms·
This is the whole reason Sucuri [1] exists and blew up in popularity shortly after it launched. If you are running Wordpress, I'd definitely recommend Sucuri.
by JoblessWonder 11y ago
This is the whole reason Sucuri [1] exists and blew up in popularity shortly after it launched. If you are running Wordpress, I'd definitely recommend Sucuri.
If you don't have a paid plan, at least run the free scan once a month or more to make sure you weren't hit by anything. I don't mind Wordpress as a CMS, but it is a constant target. Constant. And nothing looks worse than having "Cheap Canadian Viagra" at the bottom of your corporate website.
[1] https://sucuri.net/ https://sucuri.net/
- Sujan 11y agoCan you run it from the outside? Where can I find more on the free offering? (Obviously asking for my former employer... the haven't understood or fixed the problem yet.)
- Sujan 11y agoAh found it: https://sitecheck.sucuri.net/ https://sitecheck.sucuri.net/ At least the pages I looked today at aren't recognized by this external tool. Only green checkmarks, also the "List of scripts included" doesn't see the 2 scripts added dynamically by the injected code in the post. The Wordpress plugin would probably do a better job.
- eli 11y agoSeems like it would be very hard for it to catch everything from the outside. I've seen malware that only presents itself to clients with a Referer from Google or an iPhone user-agent, for example
- Sujan 11y ago100%. Although in this case the html posted in the blog post is present on all requests, all the time.
- perezbox 11y agoYup What you're referring to is Conditional Malware. We actually do very well with that, but there are no 100% solutions. There are also things that are hard, like Defacements and environments used for Phishing Lures.. All great points
- HendrikR 11y agoYou can have a look at WordFence as well which comes free of charge (and there are paid plans). It does checksumming and guards your login page. https://www.wordfence.com https://www.wordfence.com
- josefresco 11y agoNo one security solution is enough. While I also like Sucuri, it's Malware scanner tool missed a handful of infections on a recent clean up job. Microsoft Security (or whatever they're calling it now) actually found more (once I downloaded the site's files via FTP) Moral of the story, don't rely on just a plugin, or a tutorial for your WP security.
- perezbox 11y agoHey @josefresco Do you have any samples? One of the biggest reasons for this is if it's endpoint malware, versus website malware. Two very different things as you might know. Regardless, would love some samples if you any. Tony
- deleted 11y ago[deleted]
- dotBen 11y ago(going to give context for his ask + big up @perezbox here -- he's the CEO of the awesome Sucuri) @perezbox - you might want to mention that in your HN Profile. :)
- josefresco 11y agoI do have a recent example - worked out the issues with WPEngine, but it took quite a few scans. I believe they work with you, so you're probably already aware. Prior to being hosted with WPE, we used the Sucuri plugin but all scans were clean.
- jakejake 11y agoI had a client who had a security plugin installed and they were getting constant alert notifications about hack attempts. Thousands of login retries, even though there was brute-force protection. The attempts would come from a whole botnet of IP addresses to disguise that they were part of one attack. On top of the security plugin, I added an .htaccess rule to only allow access to the admin login and the entire wp-admin subfolder from within their office. They have a static IP and were OK with only having access from within the office so this worked well for them. This pretty much ended all of the attacks. I probably wouldn't rely on this as the only protection, but it definitely has been a great piece of their overall security plan. The code to do that is here: https://gist.github.com/jasonhinkle/966aee379b170f365e6f https://gist.github.com/jasonhinkle/966aee379b170f365e6f
- perezbox 11y agoI'm curious, what security tools did you have in place that were failing to stop the attacks?
- jakejake 11y agoIronically I can't login to their site from my current IP to see what security plugin they are using! It was stopping the attacks - it was just that the attacker would try 10 password attempts, then get blocked by the plugin and trigger the alert message. Then the attacker would switch IPs and try 10 more. One morning they had gotten a ton of messages and I found about 250k login attempts in the security logs. So the plugin was doing it's job, but it's better now that the attacks don't even make it that far. In fact you can't even hit a page within the wp-admin folder which is nice in case some type of zero-day exploit surfaces on a file within that area.
- SHIT_TALKER 11y agoSounds like WordFence. Email notifications are configurable. Turning off most of them is advisable. I've had trouble with users with nominally static IP addresses changing with sufficient frequency to be too much of an annoyance to stay with IP whitelist. Limiting the failed login attempts and maxing out the lockout period cuts down on a lot of the bot activity.
- giancarlostoro 11y agoI recently installed Drupal on my new domain / website (it has an .xyz extension) and a certain IP was trying to hit all sorts of WordPress related links.