This talk was originally delivered at the Melbourne WordPress Developer Meetup in July 2016. Rather than the common talks on hardening and prevention, this presentation covered how you can identify a WordPress website is compromised, and some of the early warning signs.

1. Identifying a Compromised
WordPress Site
@chrisburgess #wpmelb

2. Prevention is the holy grail,
however it’s not the topic of this
talk.

3. You can’t always prevent, so
you must detect.

4. Even if we’re doing everything
possible to harden and maintain our
installations, we should still care
about security to monitor our high
value sites.

6. Is Penetration Testing Worth it?
There are two reasons why you might want to conduct a
penetration test.
One, you want to know whether a certain vulnerability is
present because you're going to fix it if it is. And two, you need
a big, scary report to persuade your boss to spend more
money. If neither is true, I'm going to save you a lot of money
by giving you this free penetration test: You're vulnerable.
Now, go do something useful about it.
-- Bruce Schneier
http://www.schneier.com/blog/archives/2007/05/is_penetration.html

7. The following examples are
often the first signs of a
successful attack.

12. Ahrefs and Google Search Console

13. Real example of anchor text from Ahrefs

14. Real example of a malicious plugin.

15. Real example of a malicious plugin.

16. This shouldn’t be the first sign
of a compromised site. There
are usually plenty of early
warning signs.

17. But first…

19. Links to the Quora Article
• https://www.quora.com/I-am-powering-a-
banks-website-using-WordPress-What-
security-measures-should-I-take
• https://ma.tt/2015/04/a-bank-website-on-
wordpress/
• https://wptavern.com/banking-on-wordpress-
matt-mullenweg-weighs-in-on-security-
concerns

20. h"ps://www.quora.com/I-am-powering-a-banks-website-using-WordPress-What-security-
measures-should-I-take/answer/Karol-Krol?srid=uD68

21. Let’s ask another question. Is Linux
secure? Is Django secure? Is iOS
secure? Is MySQL secure? Is Drupal
secure? Is Node.JS secure? Is
<insert browser> secure? Is
Android secure? Is Rails secure? Is
Windows Server secure? Is Shopify
secure? You get the idea…
This can get subjective, since some have a
much better track record than others, and
some are designed with security as a priority.

22. So.. banks aside, what would
constitute as a high value
target?

23. High traffic sites, anything with
Personally Identifiable
Information (PII), software
vendors, service providers?

27. Credit card numbers aren’t the
only form of sensitive
information.

28. It’s really easy to say
“something isn’t secure”.

29. It’s much harder to actually
build something that is secure
(knowing that there’s no such
thing as absolute security).

30. The best answer is that if
security is important, you need
“people” working on it.

31. The Internet is a hostile
environment. We need to have
a healthy respect for this fact.

32. The current dilemma…

33. Hosting Providers

34. Plugins

35. Systems and Services

36. Users

37. Good Developers

38. Good Support, Ops and
SysAdmins

39. A high value business needs
good people, from all of these
disciplines, working together.

40. h"p://www.sentrillion.com/images/img_defense-in-depth.jpg

41. Real example of a malicious file

42. You can’t rely only on tools, they
won’t always detect a
compromise.

43. Most WordPress security tools
work by using signatures.
For context, Kaspersky AV for
Windows currently has around
500,000 signatures.

44. Scanning your site with online
tools work only if your site has
active malware, is defaced or
blacklisted.

45. If a site has been compromised,
it cannot be trusted.

46. example.com/index.php

47. example.com/otherapp/

48. example.com/*

49. example.com/*

50. Isolation
Look out for a shared web root, addon
domains in cPanel, or other web apps in
subfolders.

51. We’re going to assume a fresh
WordPress install, or restoration
from a clean backup is needed

52. Places/things to check…
• Content/files (htaccess, index.php, sitemap.xml, anything
custom)
• Running processes
• Running scripts, open files (look at full paths in processes)
• Memory
• Cron jobs
• Database
• Date and timestamps
• Suspicious plugins
• Suspicious directories/files
• Sitemaps/SERPs
• WordPress Admin Users
• Other users in GSC/WMT
• Code audit

53. Checking Content
• grep
• Screaming Frog (useful for finding JS)
• Sucuri SiteCheck
• UnmaskParasites.com
• Safe Browsing Site Status (Google)

59. Once the server has been
compromised, it cannot be
trusted.

60. Tools for Detection
• System Monitoring
• Integrity Monitoring
• Firewalls
• IDS/IPS
• Malware Scanners
• Logging

61. System Monitoring
• Resources (Bandwidth/CPU/RAM/IO)
• Logins
• Processes

62. Integrity Monitoring
• git
• wp-cli
• Any diff tools
• Plugins
• Tripwire (and similar)

63. wp-cli’s Verify Checksums
$ wp core verify-checksums
Success: WordPress install verifies against
checksums.
Thanks to @davemac for this Kp!

64. Firewalls
• Network Firewalls
• Web Application Firewalls
• Security Services

65. IDS/IPS
• Typically at the host level
• OSSEC

66. Malware Detection
• Security Plugins
• Commercial AV
• Public Site Scanning
• Google Search Console
• ConfigServer eXpliot Scanner (for WHM/
cPanel)
• Maldet/ClamAV

67. Logging
• /var/log (access, error, php)
• Centralised Logging or Log Shipping
(Papertrail, Loggly, Splunk, Logstash etc.)
• Audit trails (Stream/WP Audit Trail etc.)

68. WPScan WordPress Scanner

69. WPSecurityBloggers.com

70. Use a security plugin
(or manually harden)
https://www.wordfence.com/
https://sucuri.net/
https://ithemes.com/security/

71. Final Words…
Security issues typically occur because of
certain patterns. Cleaning, restoring or
rebuilding doesn’t address that.
Compromised sites are much more likely to
become compromised again. Get everyone
on board to take security seriously.

72. Prevention and Response
Hardening/Prevention:
• https://codex.wordpress.org/
Hardening_WordPress
Post-hack/Response:
• https://sucuri.net/website-security/what-
to-do-after-a-website-hack/

73. • WordPress.org
– wordpress.org/about/security
– wordpress.org/news/category/security
• Verizon DBIR
http://www.verizonenterprise.com/
• verizon-insights-lab/dbir/
• Sucuri https://sucuri.net/
• WP White Security
https://www.wpwhitesecurity.com/
• OWASP http://owasp.org/

74. wpmelb.org/slack

75. Thanks and stay safe!
@chrisburgess #wpmelb