I am attempting to wash up a WordPress web site that is been hacked. I observed that the .htaccess file has some suspect wanting common expressions, however my regex expertise are fairly weak (time to study I assume). I’ve tried changing the .htaccess file with the default WordPress .htaccess, nevertheless it will get rewritten instantly and routinely. What I must know is what is going on on with this code:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^([^d/]+)-([0-9]+)-([0-9]+)-.*..*$ ?$1$3=$2&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)=[0-9]+$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)..*&_.*_.*=(.*)Q(.*)J[0-9]+.*TXF[0-9]+.*FLK.*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)..*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F.*%[0-9]+F&$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F.*%[0-9]+F$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F&$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+).*[0-9]+..*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([^d/]+)-([0-9]+)-([0-9]+)..*$ ?$1$3=$2&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F&#[0-9]+;.*=.*$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)/([^d/]+)([0-9]+)(.*)%[0-9]+F%[0-9]+F.*..*..*%[0-9]+F$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^([0-9]+)-([^d/]+)_.*_([0-9]+)$ ?$2$1=$3&%{QUERY_STRING}[L]
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
If the .htaccess has been compromised, do you may have any strategies for securing it?
I did a recent WordPress set up, up to date/reinstalled all plugins, reset passwords, put in captchas for logins, moved the WordPress set up to a unique listing, and so on. Web site gave the impression to be wonderful for a couple of days, however was hacked once more. So irritating!