Blog got hacked

[MMarko]

Originally Posted by pam

Read the post I made about it -- it tells you what to look for, what files to delete, etc. 666 is a better chmod.

I've said it time and time again, 777 is easy to exploit.

Folders need at least 766 to work. You need permission to "execute" folder. Files should be 666.

[seeandsee]

Originally Posted by google

666 means read and write access for everyone.

So can somebody mess with my files that are 666?

[pam]

I set it to 777 when I upload, then put it back.

[Bradski]

Originally Posted by micho

fuck, stupid turkish hacker just hacked one of my sites. I now changed pass and deleted the index file, so now it works again. But what also should i change, so he won't do that again?

This might help tighten up your site

[gedeon]

So, here is my list what I did, pelase somebody confirm, if it's okay, or not.

Let's say, the blog is on http://www.example.com/blog/

chmods are:

/blog/ 755
/blog/wp-admin/ 755
/blog/wp-content/ 755
/blog/wp-inculdes/ 755

/blog/.htaccess 644

What exactly I don't know what chmod set to the files at the main (/blog/) as I can see those has 644. Is this right?

Second, why is necessary to change the images upload folder to the root? And if I change, should I chmod this only readable after uploading? It would be so annoying, I mean, I make a post, and login to FTP and chmod the dir all the time.

[MMarko]

Originally Posted by seeandsee

So can somebody mess with my files that are 666?

Yes it can, but that somebody has to get on your server before messing with them. This permission means owner, group and anybody else has write / read permissions for that files.

[MMarko]

Originally Posted by gedeonbacsi

So, here is my list what I did, pelase somebody confirm, if it's okay, or not.

Let's say, the blog is on http://www.example.com/blog/

chmods are:

/blog/ 755
/blog/wp-admin/ 755
/blog/wp-content/ 755
/blog/wp-inculdes/ 755

/blog/.htaccess 644

What exactly I don't know what chmod set to the files at the main (/blog/) as I can see those has 644. Is this right?

Second, why is necessary to change the images upload folder to the root? And if I change, should I chmod this only readable after uploading? It would be so annoying, I mean, I make a post, and login to FTP and chmod the dir all the time.

Yes this is fine. You can additionaly secure wp-admin folder with basic auth (password protected folders).

[ScreaM]

Man I hate hackers.

[Boddog]

I sugguest don't show your site in this forum

bec most of the hackers are from the community you have involved with

like this forum

if they know what site you have and if they think those site looks good

they will use your IP to find out what site youhave and etc

[born2blog]

this happened to me not long ago too, so I know it's not fun!!

[fresh]

Originally Posted by MMarko

Yes this is fine. You can additionaly secure wp-admin folder with basic auth (password protected folders).

Didn't you say folders should be at least 766 and now you say 755 is ok. Could you clarify that for non tech person like me

[porndragon]

Seems like alot of this is going around l8ly wonder if it's all the same guy? I'm not taking any chances I fully backed up all my sites to jump drives today and sotred them will keep backing up every couple weeks.

[thruma]

Originally Posted by fresh

Didn't you say folders should be at least 766 and now you say 755 is ok. Could you clarify that for non tech person like me

I'll give you the full tech explanation here.

take 755 for example

755
user, group,everyone else

or
1st number = user
2nd number = group
3rd number = everyone else

So the first number sets permissions for you the user of the account.
The second number sets permissions for the group your account belongs to.
The third number sets the permission for everyone else.

So how about the meaning of the numbers?

4 = read permission
2 = write permission
1 = execute permission

so the number 755 does this
user = read, write, execute permission = 4+2+1
group = read, execute permission = 4+1
everyone else = read, execute permission = 4+1

I hope that makes sense