If you have not upgraded your WordPress lately there is no better time than now.  The latest hacking attempt targets older versions of WordPress and overrides the siteurl field in the database in an attempt to force the web visitor to the hacker’s site.

Upgrading is as simple as clicking a link in the dashboard.  When a new version of WordPress is available you will see a notice near the top of your dashboard.  To manually check for an update click Tools, Upgrade.  Plugins will show in the Upgrade list and will also have a bubble over the Plugins menu option indicating the number of plugins that have updates available.

It is important to install these updates as soon as they are available to reduce the risk of a hacker exploiting your website.  These updates generally include bug fixes and security patches.

In addition to keeping your site up to date with the most current version of WordPress and all plugins, it is a good idea to maintain individual user accounts for everyone needing access to your website rather than sharing one general login.  Do not give users any higher access than necessary.  WordPress comes with four default Roles in addition to the Administrator role.  A complete list of Roles with a chart showing privileges associated with each can be found at the WordPress Codex.

For added security for your database information, it is recommended you change the permissions on your wp-config.php file to 600 which renders the file unreadable and unwritable except by the owner.  If your server settings do not permit you to use 600 the next best option is 644 (the default setting imposed during installation).

You can further deter hacking attempts by adding the following code to your htaccess file:

<files wp-config.php>
order allow,deny
deny from all
</files>

If your site is attacked…

Hopefully you have been keeping regular backups of your website.  Some web hosts include backup services with your hosting plan.  If you do not have recent copies of your website and database drop an email to your host and ask if they may have a backup of your site from the last few days.

If you have backup files you have the option of deleting all of your site files and then re-uploading the uncorrupted files from the backup as well as deleting the tables in your database and re-importing the backup mySQL file.  This is an extreme solution, but depending on the severity of the compromise it may be necessary.

At a minimum you need to do the following after restoring your site:

• change your database password immediately
• change the password for all users in your WordPress system
• change the Unique Keys in your wp-config.php file (this will invalidate all existing cookies and force all users to login again)
• correct the permissions on your wp-config.php if they are anything other than 600 or 644