0

How to remove hacker message from magento website and how to create a good security for magento website. my website is borsavela.com. how to fix it.

6
  • do you have any backup ? Sep 19, 2016 at 10:58
  • yes i have backup in my pc which file replace for previous look ... Sep 19, 2016 at 11:04
  • if you took backup recently and if you are ready to go with that than you can revert to previous backup and than check your site : magereport.com and follow all security steps mentioned in that site Sep 19, 2016 at 11:06
  • one more tip : as hackers already attacked now its better to restrict the site only to your i.p using .htaccess file. Sep 19, 2016 at 11:13
  • am trying to update files one by one i m using magento 1.7.0.2 can i update latest security patch in this version. currently can you give me suggestion which files replace for clear hack messages in shortcut because i have many files in this websites Sep 19, 2016 at 11:13

3 Answers 3

0

For this you need to upgrade the version to 1.9.2.4 and also competeble all extensions with SUPPEE-6788.

This patch was introduce for security reason from Magento itself.

And need to remove code from the admin header and footer miscellaneous code.

Hope this will help you. Thanks

2
  • which template file affected by hacker in this sichuation ?? how can easily remove it. Sep 19, 2016 at 11:02
  • They using script for it so please upgrade to newer version.
    – Mayur
    Sep 19, 2016 at 11:21
0

It happens, now first thing you need to do is restrict your site to be access only through your IP using .htaccess file.

take backup of .htaccess file and add this below code in .htaccess

credits :TBI Infotech for this link

order deny,allow
deny from all
allow from 111.222.333.444

There are lot of resources available to remove hacking code here , if that did't works for you,

next thing is as you said you have backup , than revert to previous backup. than scan you site in Magereport . there they will mention to install required security patches and changing admin and magento connect url . once you install security patches , than lot of 3 -party extensions feature may break down. you need to contact extension team to provide updated extensions that supports security features.

or if you don't have any 3-part modules , if you did't done any core files edit [ also if you are struggling to install all security patches ] , than upgrade to 1.9.2.4 version

0

My points on your issue list is never ending

  1. Rename the admin router your admin panel should not easily accessible by just base_url/admin so please rename your admin URL
  2. Admin username should not be admin
  3. Update your website to Magento new release 1.9.2.4
  4. Apply all security patches resales by Magento (check here )
  5. Give proper permission to directory and files (note: please do not give write permission unnecessary )
  6. Restrict your admin URL by IP address so other random users cannot able to reach your admin URL, for this you can use this extension

manage your code via bitbucket or any versing control system so you can revert your changes any day.

though the list is never ending but you can take above issue

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.