Title: Undetect hack?
Last modified: March 13, 2023

---

# Undetect hack?

 *  [ScytheZ](https://wordpress.org/support/users/scythez/)
 * (@scythez)
 * [3 years, 3 months ago](https://wordpress.org/support/topic/undetect-hack/)
 * Today when i entered one of my sites i saw that Chrome blocked a popup and since
   i knew i didn’t have any i opened up the Source and saw //bujerdaz.com/pfe/current/
   micro.tag.min that was injected above the source of the index. After a little
   bit of digging apparently it was a wp-push folder which had the appearance of
   Akismet Anti-Spam Current Plugin Version: 0.1.2. When i scanned it it showed 
   only that the Akismet should be updated not that it loads some redirecting plugin.
 * What’s worrisome is that it got installed in the first place with Wordfence active,
   let alone that the scan didn’t reveal anything out of place except the version
   of the plugin. The plugin is made up only from two files the index.php that hides
   the js from logged-in users and a sw-check-permissions.js.

Viewing 4 replies - 1 through 4 (of 4 total)

 *  [wfjoshc](https://wordpress.org/support/users/wfjoshc/)
 * (@wfjoshc)
 * [3 years, 3 months ago](https://wordpress.org/support/topic/undetect-hack/#post-16555224)
 * Hi [@scythez](https://wordpress.org/support/users/scythez/)
 * Wordfence protects against a vast variety of web attacks. Whether you were hacked
   because of an unknown attack method or because there is some other issue in your
   system is hard to say. Some plugins contain vulnerabilities that are new (commonly
   referred to as “zero days”) and no one has written a signature for it yet . The
   same goes for servers. 
 * Regarding how they gained entry, here are some possible scenarios:
    1. Are there other sites hosted on the same hosting account? If so, they could 
       have been infected and spread the infection to this site
    2. You may be using a plugin or theme with a vulnerability that is so severe that
       we cannot protect against it
    3. Your wp-config.php file is readable to the hacker, either directly via your 
       account, via a vulnerable plugin or via another hacked site on the same server
    4. The hosting accounts on the server are not properly isolated on the server so
       the hacker has access to your database via another user’s database
    5. The server software has vulnerabilities that allow the hacker to get root access
    6. You were actually hacked many months ago, but the backdoor was not activated
       until now
    7. You have a compromised hosting account (Change your password immediately)
    8. You have  a compromised FTP/SSH account (Remove any accounts you don’t need 
       and change the passwords on the ones you do)
 * As you can see, there are many ways that your site could be compromised. We can
   only protect you from attacks directly on your website. I hope this helps to 
   clarify.
 * Best,
   Joshua
 *  Thread Starter [ScytheZ](https://wordpress.org/support/users/scythez/)
 * (@scythez)
 * [3 years, 3 months ago](https://wordpress.org/support/topic/undetect-hack/#post-16556017)
 * Like i said, I don’t have an issue with how they got in (although i can rule 
   out some of the pointers you’ve mentioned), what is concerning is that the files
   didn’t rang any bells when (automatically or manually) scanned. I don’t expect
   a WP site to be fort knox but i do expect to find and notify about a JS that’s
   obfuscated and a code that hides a script from the admin users. That’s a rather
   basic thing from a malware scanner i’d say.
 * Thanks for the reply tho’.
 *  Thread Starter [ScytheZ](https://wordpress.org/support/users/scythez/)
 * (@scythez)
 * [3 years, 2 months ago](https://wordpress.org/support/topic/undetect-hack/#post-16641274)
 * maybe if more and more people will complain about this they’ll bother to investigate
   rather than put generic copy/paste answers.
 * so far after clean up i haven’t had any more issues but I still don’t know how
   they entered or how they evaded the scans of Wordfence
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [3 years, 2 months ago](https://wordpress.org/support/topic/undetect-hack/#post-16641467)
 * > maybe if more and more people will complain about this they’ll bother to investigate
   > rather than put generic copy/paste answers.
 * Not in this topic.
 * If someone else needs support then per the forum guidelines they need to please
   start their own topic.
 * [https://wordpress.org/support/forum-user-guide/faq/#i-have-the-same-problem-can-i-just-reply-to-someone-elses-post-with-me-too](https://wordpress.org/support/forum-user-guide/faq/#i-have-the-same-problem-can-i-just-reply-to-someone-elses-post-with-me-too)
 * They can do so here.
 * [https://wordpress.org/support/plugin/wordfence/](https://wordpress.org/support/plugin/wordfence/)

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Undetect hack?’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 5 replies
 * 5 participants
 * Last reply from: [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * Last activity: [3 years, 2 months ago](https://wordpress.org/support/topic/undetect-hack/#post-16641467)
 * Status: not resolved