Wordfence was blocking all visitors and my email was full of blocking emails. It was supposed to block when a visitor or hacker only tries to find non-existent PHP or script pages to exploit vulnerable codes and pages and inject malware/virus.
inbox was full of IP-blocking messages
But due to a cache problem a lot of CSS files were missing, it was a plugin error of the cache plugin. So when any visitor was visiting the site a large number of CSS scrips was not found automatically therefore wordfence blocked the visitors.
Let’s share screenshots from my PC to walk you through the process of how I found the issue and solved it:
Step:2
I checked the Wordfence dashboard and found CSS files missing problem led to all IP blocking.
Step 3:
I visited the website Dakhm.com and found many missing 404 CSS files due to cache problems.
Step 4:
Then I tried to visit another page of the website, but now Wordfence blocked my IP too like other IPs.
Step 5:
In this step, I need to unblock myself and login to the website to remove my IP from Wordfence block list. I will be using Filezilla for FTP to change Wordfence plugin’s folder name so that Wordfence plugin is deactivated. In this way, my ip will be unblocked as the plugin itself is deactivated.
Step 6:
I could log in after deactivating the Wordfence plugin.
Step 6:
Follow the screenshot below to clear the cache from the wp optimize cache plugin.
Step 7:
Then go to Cloudways as per the below screenshot, and clear Varnish cache from your server.
Step 8:
Then go to Cloudflare as per the below screenshot, and clear Everything.
After clearing all cache I saw there was no missing css files, from chrome inspect element.
Then change Wordfence plugin’s folder to real name with FTP and login to website and activate the plugin, then go to the blocking option and unblock necessary ips, like below screenshot. And you are done.
Share this article if it helps.
If you need help regarding any WordPress/website issues, you can contact me.
On auto scan Wordfence security plugin pointed out a hacked file. From cloudways help they were saying about such file that is taking server resources, maybe this is the file after hackers attacked the site continuously and making the server CPU usage high for last few weeks.
We were randomly checking our website from mobile and to our surprise when I googled specific keywords from the WordPress woocommerce e-commerce website Dakhm.com and tapped on the search result of Dakhm, it took us to that Dakhm’s page but it auto-redirected to a couple of other websites and landed on a betting site. It was clear like a day that the website was hacked. After 1-2 days of work, I was able to find the malware with the plugin and deactivated it, now it is working fine. Dive into the article below to learn from our journey.
How did we find our website was hacked?
One of the customer over call asked for a products price, I searched with my mobile with that product name by adding Dakhm to it so google will show Dakhm’s product on first place. I tapped on the google result and on Dakhm’s product page I couldn’t tap anything and it auto redirected to other random websites. I was frustrated and understood something was wrong and website was hacked. Another abnormal fact was, when we visited from google search one of the popups by Popup Builder was automoataclly popup. Though that pop up should not pop up automatically by default when visiting the product page or any other page as that pop up was setup to pop on mouse click.
Server CPU usage was high and website was not loading
CPU usage was high on the hosting and website was not loading at all the previous days, maybe that CPU high usage was there for past 2 days. I was checking back server at Cloudways and showing CPU and ram was high constantly and not letting the site be online for more than 1 hour. I checked Cloudways monitoring tabs where I could see random ips from outside Bangladesh was accessing large number of json files constantly and those ips was not checking any product but other URLs. Normally I can understand the pattern of bots and hackers from outside Bangladesh, as Dakhm is only available for Baangladeshi customers so google will not show search results to foreign countries therefore we don’t visitors from outside Bangladesh that often. Also normal visitors checks products and and their account. When I saw large number ips from other countries was hitting Dakhm and exhausting server resources, I realsed something was not right.
How did we understand the attack on the site?
I took the ips from Cloudways and searched them on https://www.abuseipdb.com/check/23.22.35.162 and found people already reported those ips. I contacted Cloudways support, but they couldn’t point out the those ips as hackers as they didn’t suggest anything to protect the site or blocked those ips. We were bit confused to block or not block those ips? What if those are search engine bots? Cloudways support people are really good, they takes time and responsibility to solve issues but they can not solve all the issues and I can understand their effort and I have no complaints. So I let it as it is due to many ips and I can not block all the ips and wait for the server resources to back to normal. Again on the Dakhm’s product page if we tap any link the redirection starts so this is clearly a javascript issue and JS code was injected.
What cloudways did to minimize the server load?
They restarted my server in that way server load was back to normal but the attack started all over again, and I had nothing to do but wait to get back to normal.
What steps did we take to point out the hacked code?
I previously solved many hacked websites and have seen problems before. Some of my tricks are below:
Look for redirected website names on source code of the effected site
You can inspect element the effected site and search for names of the redirected websites and see which code is making the redirection, but this method was not working here.
Inspect Element using Chrome browser
Inspect element every possible way to look for the redirection code with Chrome developer tools, this method did not work either, maybe chrome has advanced tools that we need to learn to analyze such hacking code injection
Wordfence security plugin
We initiated a site scan with Wordfence though the wrdpress plugin was activated during site hacking but this plugin couldn’t stop such an accident. Also, Wordfence was not able to scan the whole site, we tried multiple times and this plugin has limitations and this plugin was no use either for now.
Cloudways Support
Their chat agent was unable to say about the malare, he created ticket for other department to solve. Later another support team member contacted and scanned the site but was not able to pin point the effected code. I asked him if he can point out the exact file or code, he said it was not their scope and asked me take their paid security service.
How did we remove the malware?
From their screenshot above I found out “pbuilder” type of word, I searched source code with it but found nothing but I saw “builder” type word on pop plugin div class names. I deactivated the pop up plugin and Thanked Allah! the malware was removed, so the attacker injected the code on that plugin.
Final check
I checked their support form https://wordpress.org/support/plugin/popup-builder/ and saw other people also reported the hack, so I was 200% sure and relieved. But the pop up function on the site remains broken as I deactivated the plugin.
What precautions should you take to avoid such hacking?
Actaully there are no specific operation to take. It is good to update all the plugins and themes time to time. And look for any abnormal changes after each plugin update or anytype of update. In my opinion the hackers exploited the weak spot of the plugin and did the attack so it is entirely the plugin’s fault.
