How to cure a website from a virus?

Question

PHP

Hello! Got a "inherited" site on WordPress hosting jino. I recreated the site on the same WordPress, nothing was left of the old one, after a couple of days I noticed that the site was infected. I deployed a new WordPress again, took the base and my theme from the old one, and a virus again in a couple of days. I began to look at what has changed, the theme files are the same, I compared the base - the same, but there are a lot of new incomprehensible files in the WordPress files, a modified htaccess that redirects to external resources. I want to find out why the virus comes, I studied the infected site, changing the database and theme does not change anything, probably it’s not about them (I hope so, because I wouldn’t want to re-layout the entire site and fill in the database). I took another hosting, uploaded the original version of the site there - a few days passed and it was safe and sound. Is it a matter of hosting? I'm just afraid that the virus would not manifest itself again on the new hosting. How to protect this site from a virus, should changing the hosting solve the problem? I apologize for the rambling presentation. Has anyone encountered this problem, please share your opinion.

Answer 1

I began to look at what has changed, the theme files are the same, I compared the base - the same, but there are a lot of new incomprehensible files in the WordPress files, a modified htaccess that redirects to external resources

For this I would recommend using GIT or another VCS, you can track the changes "to the letter".

I want to find out why the virus is coming

Because it is his duty to come. The virus is like a tax inspector, whether you like it or not, it will come anyway.

changing the database and theme does not change anything

And it should, change the subject, at least - should change the subject.

I took another hosting, uploaded the original version of the site there - several days passed and it was safe and sound. Is it a matter of hosting?

Perhaps in hosting, perhaps in the fact that someone does not store FTP passwords securely. It is possible that a neighboring site was hacked, and you have "777" rights somewhere, which allows you to upload files to your account or ... (1000 other reasons).

I'm just afraid that the virus would not manifest itself again on the new hosting.

When using popular CMS, in particular Wordpress, the word "virus" will follow you almost around the clock. Remarkably, about 15% of the latest massive WP hacks were due to a bug in a plugin that should prevent hacks, increase security, etc.

How to protect this site from a virus,

options:
1. Do not use popular CMS, or at least - do not install third-party plugins on them that have not passed security tests (which is about 99% of plugins of almost any CMS)
2. Do not use cheap unverified hosting, or even better - get a personal VPS
3. Make backups, at least daily (or after each change on the site)
4. Connect site antivirus (with this question - in support of the hoster)

Should changing the hosting solve the problem?

It is possible, but far from being a fact, that the matter is exclusively in the hoster.

Answer 2

VirusDie
+ see file access logs

Answer 3

If you do not want to figure out how to cure an infected site from viruses, you can go here: www.secbot.org/vylechit-sait-ot-virusov/