Site security

I have been working all day on making sure this web site is safe after that DreamHost security break-in. Many other people have also been hit by this.

As far as I can tell, my site did not have any of the spam links inserted into my web pages. This suggests I am part of the group who had their FTP password stolen, but nothing changed.

However, I am now extremely paranoid.

A list of what I have done so far:

  • Changed all of my passwords on this site and dreamhost (that means dreamhost panel, ftp, wordpress, mysql, etc.). I may decided to generate completely random passwords that are all different for each component.
  • Completely deleted every file on my web site (after a backup of course). I have downloaded a completely fresh copy of WordPress and just installed it.
  • I have switched to the default WordPress theme for the time being, until I can comb through the code on my old theme to make sure it is safe.
  • I will check all of my plugins, download the latest versions of them, and install the new versions.

Remember WordPress users (and I am sure other web site software suffers from the same problem), your mysql password is kept in the wp-config.php file. I highly recommend you change your MySQL password.

In fact, I highly recommend that ALL DreamHost customers change their passwords. I wonder if the initial count of 3,500 accounts compromised could be low.

What a mess. I hope DreamHost figures out how this happened.

One thought on “Site security

  1. Well … it’s managed hosting so keeping everything secure is pretty hard.

    I have around 120 websites hosted with dreamhost … over 30 users, 50 databases … so changing all those passwords is not such a good idea (and it might take a long long time to do it).

    Then ones responsable for these hacks are the programmers of those php files.
    I had hackers too, but they managed to poo on my sites because a security hole i had in one of my files.

    Disable file uploading asap.7

Comments are closed.