1

We are facing a weird problem. We have a site set-up in Joomla. The site is getting hacked on a regular basis and specifically during the weekends. The strange thing is, we see that a new user is added everytime the site gets hacked. Also that this user is provided with Admin rights.

We have removed the previous users and have restored the site but the issue is continuously happening for the past 4 weeks and we are absolutely clueless as to how this is happening. We have updated the Joomla version and have performed all that is necessary but the issue still keeps on happening.

Please help us out in case any of you have faced a similar situation ever.

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
3

There are many resources you can find regarding a Joomla hacked site, either by googling it, or simply searching in this site.

Here are some links:

Make sure you read them carefully and take all actions that apply to secure your site.

Now, why you are constantly being hacked, even after updating Joomla:

  1. If you go through and read on the above links, you will realize that security isn't only a case of 1 thing, but many things combined. So for example some common issues: Someone knows your credentials (FTP, Hosting, Joomla, Database), you are hosting many other sites under your account and one remains vulnerable, an extension (can be disabled) is still out of date and insecure, your hosting company is inadequate to provide secure hosting, your server software is out-of-date and so on, or your own computers are infected and hackers gather sensitive information from them and so on.

  2. Of course, when a website has been already hacked, there is a full list of actions that must be taken, in order to clean it up and secure it. If you simply updated Joomla core, then most likely I could say that you still have a backdoor in your system. Likely the hackers have uploaded their malicious files and they still have control.

Since website security isn't a simple topic, I would recommend to hire someone with the required experience to release you from the pain.

Improve this answer
2
  • Nice answer and the only thing I'd add is to check administrators computers in case any of these are compromised and hackers are discovering credentials via locally stored FTP clients or similar.
    – Neil Robertson
    Commented Apr 5, 2016 at 10:37
  • 1
    @NeilRobertson:: yes thanks for mentioning it - I will add it on the answer, so it is included there for future readers.
    – FFrewin
    Commented Apr 5, 2016 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.