保护Wordpress网站免于添加垃圾邮件脚本？

Question

Once found a spam script on site, I removed it, changed all ftp and wordpress passwords and installed Sucuri Security plugin. And now, after 3 weeks, again spam messaging is detected and I found in Sucuri Security logs this record:

system 127.0.0.1 New file added: (multiple entries): wp-admin/.htaccess (size: 244) wp-admin/ms-default-constants-stat.php (size: 11674) wp-content/.htaccess wp-content/wlwmanifest_backup.php

In last login logs, there was no successful logins in these 3 weeks. And I doubt that hackers guessed ftp password. Changed all passwords anyway but now I would like to prevent this in future. Are there ways to prevent this from happening again?

Answer 1

Do one thing install gotmls wordpress plugin in your wordpress site 1) update the key after registration 2) scan the whole site 3) after this install wp-security plugin to make site more protected

Hope you will get your solution Cheers :)

Answer 2

Wordpress hacks are often due to outdated plugins, sometimes included in the theme (and not installed/updated by Wordpress itself). Check with your theme's author if you're using a paid theme.

Spam scripts themselves also never come alone: once a hacker gets in, they automatically deploy several (possible hundreds) of backdoors, shells and ways to get access back if you decide to remove their spamming script.

Hacks are best cleared by restoring a backup which you can guarantee is 100% clean and updating everything. If you can't do this, you'll need to use several malware scanners to get rid of the scripts.