Wordpress plus Dreamhost = hacked Wordpress blog

[almostwitty]

I host my main blog on Dreamhost, using Wordpress. This may have been a fatal mistake.

A while ago, someone emailed me to kindly point out that my site had somehow been hacked, and spam links injected into my HTML code. It wouldn’t appear on the site to human eyes, but it’s all there in the HTML code and picked up by Google et. al.

I changed all my passwords (Dreamhost, Wordpress, FTP), removed the hacked code and thought the problem was over.

Oh no. It’s just come back. Only this time, I can’t figure out where the code is. And since I changed all the passwords to begin with, it means that either Dreamhost or Wordpress has become seriously compromised. Although naturally my Google-fu is failing me and I can’t figure out where the problem’s come from. Although this post gives one indication.

Now I’m debating whether to carry on with this blog or move to yet another blogging platform like LiveJournal or something… bah… Or I could give up. It’s been six years, after all…

Originally published at almost witty. You can comment here or there.

Comments

[almostwitty]

Well, when was the last time you saw LJ doing anything new?

[kiri-l.livejournal.com]

depends on what you mean by new. The news thing (about once a month) goes on about stuff. There's usually something updatey in there.

[almostwitty]

Well, new as in new features to play with that actually make the blogging system better.

What LiveJournal in its SixApart and new owner guise seem more concerned with is bringing in new content partners and turning it into a content portal. Which is fine in many ways but well, that's what everyone else is doing.

[kiri-l.livejournal.com]

new features like what?

[almostwitty]

ooh, like embedding widgets into the right-hand nav? Allowing non-LJ people to put their website or name in comments?

[kiri-l.livejournal.com]

oh. so like someone could use openID or soemthing? (which btw can be used on LJ)

[almostwitty]

Well, no, people can use OpenID.. but then most people aren't aware that they've *got* an OpenID.

And what if you don't even have a website? Where do you put your name?

[kiri-l.livejournal.com]

I've never put an url in the website thing. Isn't needed.