True story: How website clutter can get your site hacked

My personal blog got hacked last month. Ouch. Visitors who clicked a search result link to my site were getting redirected to some Russian site. Luckily I realized it pretty quickly and fixed it within 24 hours, but the damage had been done – I lost almost a day’s worth of traffic and some new visitors.

I did however, learn an important lesson from the experience – website clutter can get you hacked.

What’s lying in the hidden corners of your website?

After fixing my site I immediately investigated the source of the hack to make sure it doesn’t happen again. I realized that the attack vector was an old inactive theme laying around on my web server.

Yes, not clearing out my old theme files got me hacked. I can just hear my mom’s voice telling me to pick up my room…

This outdated theme was vulnerable to the TimThumb exploit. Although it was inactive, the vulnerable script was still there on my web server. A bot probably just checked whether /wp-content/themes/themename/timthumb.php exists on my server and when it found the script there, it proceeded to exploit my site.

If you have the Thesis or Headway 2.x themes, or older WooThemes you should go into your WordPress dashboard and delete the old versions of those themes from your server immediately. These are a few themes that I’ve used and that I know may trip you up because of how the update mechanisms work.

Note: Headway 3.x does not have this problem any more so you should definitely upgrade if you’re still sticking with version 2.x

Outdated plugins and themes

I’ve stressed the importance of keeping WordPress updated before, but here’s another piece of advice that should be taken to heart: delete your inactive plugins and themes.

We all love installing plugins and themes. Unfortunately we’re not so good at clearing out old plugins and themes. As I learnt the hard way, having inactive themes and plugins just laying around on the server can pose a security risk.

Clear out the clutter. If a theme or plugin is not in use, don’t just leave them laying inactive on your site. Delete them to make sure that they don’t come back to bite you in the ass.

Old backup files

Other pieces of clutter that are potential disasters waiting to happen are backup files left in your root directory. I’ve logged into many web servers and I see stuff like this:

public_html
- sitename.com_v1
- wp-admin
- wp-content_old
- wp-content
- ...

Do you see the problem? Outdated files in the the backup folders can contain outdated plugins and themes, and vulnerable files that can be used to exploit your site. If you need to store backup files on your web server, don’t let them clutter up the public_html directory. You should zip up your files and put them above the public_html directory.

Outdated files are dangerous, even if they’re not active

WordPress is actually a very secure platform but we constantly overlook “the little stuff” which then compromises our sites. Remember that inactive themes and plugins can contain vulnerable code which can be executed by anyone with a web browser.

If a hacker finds it, you can be sure their next step is to exploit your site. The next thing you know, your site will be redirecting people to phishing sites, spreading malware or worse, be used in phishing scams.

So before that happens, have a quick look around your web server and clear out any clutter that may be waiting to trip you up. If you need help, give us a shout on Twitter by tweeting @clickwp or get in touch via our contact form.