As you may have heard, on Friday evening I got what was to be the first of a couple of emails from some very helpful people telling me that there was a big message up from Google saying that WPShout contained viruses, spyware, the lot! I took a look for myself and sure enough, WPShout had been hacked somehow.

This isn’t good.

I’m fairly happy with my security; there are lots of little tips and tricks I use that make the site harder to hack than most, leaving me with the impression most hackers just wouldn’t bother and move on to the thousands more WordPress blogs without the extra layer of security.

I was wrong, evidently.

So how did they get in?

I’m not going to lie, I’ve still no idea. I’ve got my suspicions but until I’ve got the time to investigate, it’s very much in the dark. In the meantime I’ve put in place some “emergency measures” blocking access to just about everything for everyone apart from me, on my IP.

How did you fix it?

I found out just as I was about to go out so the quick fix was to restore a backup. This got the issue to go away immediately so whilst not the best way of doing things, worked.

So what can I do to make my site safer?

I don’t think I’m really qualified to answer that question anymore! The security category archives’ advice is still relevant and will give you that extra layer of protection. Ultimately, it’s not enough and without a dedicated server, secure backend sessions and the like it’s very hard to have a “secure” site on shared hosting.

That’s not particularly helpful, but it’s (in my opinion) true. That doesn’t mean you can’t do anything though; make sure that extra layer of security is there and only hackers who are determined enough will bother to make the breakthrough. Having up-to-date backup archives is really important too. That way you can quickly restore your site to a working state whilst you find the threat.

Good luck, you might well need it!