How to remove hacker message from magento website and how to create a good security for magento website

Question

How to remove hacker message from magento website and how to create a good security for magento website. my website is borsavela.com. how to fix it.

Answer 1

For this you need to upgrade the version to 1.9.2.4 and also competeble all extensions with SUPPEE-6788.

This patch was introduce for security reason from Magento itself.

And need to remove code from the admin header and footer miscellaneous code.

Hope this will help you. Thanks

Answer 2

It happens, now first thing you need to do is restrict your site to be access only through your IP using .htaccess file.

take backup of .htaccess file and add this below code in .htaccess

credits :TBI Infotech for this link

order deny,allow
deny from all
allow from 111.222.333.444

There are lot of resources available to remove hacking code here , if that did't works for you,

next thing is as you said you have backup , than revert to previous backup. than scan you site in Magereport . there they will mention to install required security patches and changing admin and magento connect url . once you install security patches , than lot of 3 -party extensions feature may break down. you need to contact extension team to provide updated extensions that supports security features.

or if you don't have any 3-part modules , if you did't done any core files edit [ also if you are struggling to install all security patches ] , than upgrade to 1.9.2.4 version

Answer 3

My points on your issue list is never ending

1. Rename the admin router your admin panel should not easily accessible by just base_url/admin so please rename your admin URL
2. Admin username should not be admin
3. Update your website to Magento new release 1.9.2.4
4. Apply all security patches resales by Magento (check here )
5. Give proper permission to directory and files (note: please do not give write permission unnecessary )
6. Restrict your admin URL by IP address so other random users cannot able to reach your admin URL, for this you can use this extension

manage your code via bitbucket or any versing control system so you can revert your changes any day.

though the list is never ending but you can take above issue