When trying to evaluate your own security, remember the old addage: “A chain is only as strong as its weakest link.” Here is story of some recent experiences I had which reinforced this for me.
About a month ago, I started seeing all kinds of articles online related to a massive amount of websites being hacked. Most of these hacks were WordPress sites hosted with a large hosting company such as GoDaddy. This site is WordPress hosted by GoDaddy, so when I saw this, I was very interested.
I read the articles to find out how to know if your site had fallen victim to this. The main goal of this attack was to place a bit of php code into every WordPress file on your server. When WordPress would serve up a page, this code would be executed. The result would be a redirect placed in each page that a user of your site would see. This would redirect the user to a malicious website which would attempt to exploit your site’s visitors.
I immediately checked the content of my site and was relieved to find that my site appeared unhacked. But I was not out of the woods yet. No one yet had figured out how the hack was able to infiltrate all these systems. Many people were blaming it on a flaw in WordPress. Others were blaming it on a flaw with GoDaddy’s hosting. Until I figured out where the flaw was, I was still at risk.
This hack was showing up on web platforms other than WordPress. This makes it seem like it couldn’t be a problem with WordPress that was allowing this to happen. But, it was also happening on hosting providers other than GoDaddy. On top of that, if it were a flaw in WordPress or GoDaddy, this hack would be capable of showing up on many more high-traffic pages. You would think that a hacker armed with an unknown exploit with such power would hit the biggest targets available, instead of just a few tiny blogs.
GoDaddy was blaming it on people using out of date WordPress installations. However, I read many articles reporting about people who got hacked, rebuilt their sites with the newest version of everything, and then immediately being hacked again.
The root cause of this hack still hasn’t been figured out as far as I know. I have read that a large number of the affected sites had some weak passwords. At this point, I believe this to be it, but there is no way for me to know for sure. I use very strong passwords. Maybe this is what saved me. Or maybe the hackers just hadn’t found this site.
The moral of the story is to remember you are only as secure as your weakest link. You can build a house out of solid steel with a vault door and barred windows, but if you leave a spare key under your doormat, how much more secure are you? WordPress and GoDaddy can be completely secure, but a guessable password makes it irrelevant.