{"id":38025,"date":"2018-10-04T21:45:03","date_gmt":"2018-10-04T21:45:03","guid":{"rendered":"https:\/\/www.thewordcracker.com\/en-us\/?p=38025"},"modified":"2018-10-04T21:45:03","modified_gmt":"2018-10-04T21:45:03","slug":"remove-all-publicly-accessible-config-backup-or-log-files-for-security","status":"publish","type":"post","link":"https:\/\/www.thewordcracker.com\/en-us\/remove-all-publicly-accessible-config-backup-or-log-files-for-security\/","title":{"rendered":"Remove all publicly accessible config, backup, or log files for security"},"content":{"rendered":"<p>A few days ago, I repaired a malware-infected WordPress site. WordPress itself is secure but the level of security could be compromised when you do not update the WordPress core files, themes or plugins in a timely way.<\/p>\n<p>After deleting malicious code from database, I checked the web server and removed some strange files. I could not find additional suspected files.<\/p>\n<p>I installed the <a href=\"https:\/\/wordpress.org\/plugins\/wordfence\/\" target=\"_blank\" rel=\"noopener\">Wordfence Security<\/a> plugin and scanned the site for malware.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-38026\" src=\"https:\/\/www.thewordcracker.com\/en-us\/wp-content\/uploads\/2018\/10\/bakcup-file-compressor.jpg\" alt=\"WordPress security\" width=\"947\" height=\"355\" srcset=\"https:\/\/www.thewordcracker.com\/en-us\/wp-content\/uploads\/2018\/10\/bakcup-file-compressor.jpg 947w, https:\/\/www.thewordcracker.com\/en-us\/wp-content\/uploads\/2018\/10\/bakcup-file-compressor-300x112.jpg 300w, https:\/\/www.thewordcracker.com\/en-us\/wp-content\/uploads\/2018\/10\/bakcup-file-compressor-768x288.jpg 768w\" sizes=\"(max-width: 947px) 100vw, 947px\" \/><\/p>\n<p>Two critical warnings were displayed when the scan completed. There was a backup file of config.php. I think someone updated the config.php file and left the old file as a backup. However, it might be publicly accessible and insecure and all such files need to be removed. (It'll be better to store them in your desktop or cloud server.)<\/p>\n<p>You know, <a href=\"https:\/\/wordpress.org\/plugins\/duplicator\/\" target=\"_blank\" rel=\"noopener\">Duplicator<\/a> is a handy tool for migrating WordPress installations from one server to another. However, some users leave the Duplicator backup files (including a script file) in the server, which also could be very dangerous.<\/p>\n<p>It's strongly recommended to delete any Duplicator backup files from the server after restoring your site.<\/p>\n<p>Since WordPress is very popular, vicious hackers target WordPress sites which have not been patched in a timely manner. Therefore, always maintain your WP site safely by updating the WordPress core files, themes and plugins to their latest version.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A few days ago, I repaired a malware-infected WordPress site. WordPress itself is secure but the level of security could be compromised when you do not update the WordPress core files, themes or plugins in ... <\/p>\n<p class=\"read-more-container\"><a title=\"Remove all publicly accessible config, backup, or log files for security\" class=\"read-more button\" href=\"https:\/\/www.thewordcracker.com\/en-us\/remove-all-publicly-accessible-config-backup-or-log-files-for-security\/#more-38025\" aria-label=\"Read more about Remove all publicly accessible config, backup, or log files for security\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":38027,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5],"tags":[6,465],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.thewordcracker.com\/en-us\/wp-content\/uploads\/2018\/10\/Security.jpg","_links":{"self":[{"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/posts\/38025"}],"collection":[{"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/comments?post=38025"}],"version-history":[{"count":0,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/posts\/38025\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/media\/38027"}],"wp:attachment":[{"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/media?parent=38025"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/categories?post=38025"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thewordcracker.com\/en-us\/wp-json\/wp\/v2\/tags?post=38025"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}