DreamHost Hacked

Do you have a website that keeps getting hacked? Is your server getting compromised often? It could be a security breach with your host. But in 95% of such cases, your vulnerability is due to insufficient security at your end.

DreamHost has experienced many such breaches recently. And we know this because we’ve personally cleaned several infected websites for our clients. If you too have suffered from this, here is a tutorial to recover your DreamHost hacked website.

Let’s first find the cause of hacking in our next section.

Why was the DreamHost website hacked?

There could be multiple reasons behind the hacking of your DreamHost website:

Vulnerable WordPress Plugins

The most likely reason behind a hacked DreamHost website are vulnerable WordPress plugins. WordPress is a target for hackers performing bulk attacks as it remains the most mainstream content management system (CMS).

These hackers probably utilize automated scanning tools for infecting WP sites. This way vulnerable, unsupported, and out-of-date plugins are targeted without even needing human intervention.

Weak Passwords

Using generic or dummy passwords also paves the way for hacking. Many website owners also reuse passwords they use on other sites. So it becomes easier for hackers to crack them and infect the website.

Untrusted Installations

Installing themes and plugins from untrusted sources is another major cause of hacking.  Such WordPress installations might have several security vulnerabilities. It is also equally important to keep these installations up to date.

Key Takeaway: If your DreamHost site got hacked due to any of the above reasons, the problem will persist even if you move it to another host. It is because your WordPress site is already broken.

Suppose you have many websites under a single DreamHost account and one of them is attacked. All other websites are also infected since they share the same cPanel as the attacked site.

In such a case, Google displays a “hacked” notice for all these sites as shown below:

How To Fix DreamHost Hacked Site and Suspended Account?

Consider investigating deeper into your website’s vulnerability before fixing your DreamHost hacked site. Review all the post requests in your site’s Apache access logs immediately before unauthorized file changes.

It might show you how your website was compromised.

Let us now have a look at the steps to fix the DreamHost hacked website:

Step 1 – Restore the older version

DreamHost allows you to roll back all website changes with its backup feature. It performs daily backups and retains the data for up to 2 weeks.

Find all your backups under the Domain management tab of your DreamHost control panel. Roll back your site to the last backup created before the unauthorized file changes.

Step 2 – Manually clean

The next step is to manually clean any malware from your website. Replace all the old WordPress core files with new ones. Make it a point to create a website backup before performing this step.

Also, examine your website carefully for any backdoors by using these keywords:

• str_rot13
• eval
• gzinflate
• base64_decode
• preg_replace

Step 3 – Install security plugins for malware removal

After manual cleaning, it’s time to install security plugins on your site:

Wordfence

Wordfence is one of the best security plugins for WordPress sites. They offer inexpensive hack removal. You also receive pro protection for a year along with site cleaning.

Only a handful of free security plugins actually use a firewall, and Wordfence is among them.

Visit Wordfence

Anti-Malware Security (For Scanning)

This plugin is powerful enough to detect the malware Wordfence sometimes fails to identify. So it complements Wordfence pretty well.

Visit Anti-Malware Security

Step 4 – Hire a Developer

An expert web developer will help you detect the source of the hack and clean your site. They can also strengthen the security of your website to prevent further attacks.

The developer will have experience and knowledge of this work. They might even have solved a similar malware problem in the past. So you can expect them to fix your site much faster thereby minimizing your website downtime.

Overall, paying a professional will result in a much smoother and more effective site cleaning experience. You can easily hire one from any freelance website.

Step 5 – Rebuild your site (optional)

Complete rebuilding is recommended when your website gets hacked repeatedly. It will be more time-efficient to have a fresh WP installation than clean an infected one every time it gets compromised.

You can import your website content to a new, clean WordPress.

This solution might not be ideal for old sites with lots of data and complexities. In such cases, it is best to restore your website to its pre-hacked version via the backup restore option.

Rebuilding is also an excellent option for website owners who do not want to spend money on professional malware removal.  But, if you chose to do this, be sure to secure your new installation to prevent future malware attacks.

How to prevent being hacked again?

DreamHost websites are generally not secure enough, which is what leads to their regular hacking. So, you cannot rely on the host to assist you technically with these security problems.

But hopefully, this tutorial will help you secure your site:

1. Upgrade to VPS or Dedicated

It is recommended to keep your websites in separate cPanel accounts, so that one account won’t have permission to access anything from the others. And if one of your websites gets hacked, the others will remain safe.

This kind of account separation is available either with reseller hosting or VPS/dedicated server plans. It is also viable to buy individual hosting packages for different websites.

One of our clients uses this strategy to protect and isolate their websites.

2. Fix Server Misconfigurations

Wrong server configurations make your website vulnerable to attacks. So fix all these misconfigurations to secure your website:

• Weak file permissions: Hackers can access your .htaccess and other sensitive files when the permissions on them are not properly set. Then, these files are modified by the attacker to inject malware into your DreamHost website.
• Open ports: Hackers enter your website via open ports. Make sure you have no open ports when using the DreamHost VPS plans for the safety of your website.
• Enable two-factor authentication: Enabling two-factor authentication (also referred to as 2FA) restricts the entry of hackers to your site. Configure it for your DreamHost website from the cPanel.
• Remove old files: Old software and files on your server make your website vulnerable to attacks. So, regularly clear all the outdated software and old license files from your DreamHost website.

3. Keep Everything Updated

Ensure to update all your website resources regularly. This includes your WordPress core files, plugins, and themes. Also, make sure you download them only from reliable marketplaces.

4. Optimize Security Plugins

Even after you install and optimize a trustworthy security plugin like Wordfence, it’s important to set it up properly and strengthen its security settings. Since Wordfence is quite popular, you can find many tutorials on how to clean a hacked site with it.

5. Check Anonymous Accounts

Regularly review all user accounts on your site to keep a check on unauthorized access. Analyzing the strength of your passwords from time to time, and adapting them accordingly, can further help keep such unwanted visitors away.

6. Migrate to a Different Host

Shared hosting and DreamHost are two big enough concerns on their own. Your site is never fully secure when you use shared hosting. And DreamHost doesn’t come to your rescue if other server users breach your space.

Consider moving away from DreamHost since it is simply not reliable enough. Instead, migrate your websites to a hosting provider that actually performs regular security updates.

What to look for in the new host?

When looking for a new provider, check the availability of a firewall system like Cloudways or for the use of the Imunify platform. These are the best tools to prevent attacks on a server and all the sites residing on it.

Overall, your managed hosting solution should offer good support. For your part, you should also update your WordPress and plugins every week, and maintain offline backups.

If you’re still unsure about which hosting solution to go for, we have compiled a list of reliable hosts here in the panel to the right. You can choose any solution from here, and be assured of quality service.

Is DreamHost hack site repair worth buying?

Frankly, DreamHost hack site repair is not worth buying if you have enough technical familiarity to follow the steps we’ve listed above.

This DreamHost pro service is effective in removing website malware. However, the host connects you with its technicians only via email tickets. So the process is slow and will lead to longer website downtime.

But if you want an expert to clean your website and can afford the service, you can consider purchasing it.

Is DreamHost secure?

No, DreamHost is not secure. It has experienced serious security issues repeatedly in the past.

Vulnerability found

DreamHost servers have a serious vulnerability which was found a while ago:

Account takeover using cross-site scripting (XSS) flaw

As shown in the above image, this vulnerability has a serious impact. It allows the attacker to modify the victim’s email or password quite easily. Even if the victim only visits the link to a legitimate website, the malicious script also loads.

Database leak

DreamHost also became a victim of a database leak in April, 2021. A total of 815 million user records were compromised. As a result of their emails and other info getting leaked, the customers all became victims of spam and phishing attacks.

Conclusion

To prevent frequent hacking, it is important to learn how to secure your WordPress site. Most hosts focus on making higher profits by utilizing freeware scanners. Only a few invest in commercial security software.

Move your website to a cheaper but more secure host than DreamHost. An option that provides essential security features for free is Cloudways.

We use it for our website as it offers:

• Dedicated Firewall & Bot Protection
• DDoS protection
• Application isolation, and more

Hope you enjoyed this DreamHost hacked website recovery guide. If yes, please share it. Also, bring up your queries in the comment section.

FAQ (Frequently Asked Questions)

How does DreamHost deal with the hack?

DreamHost scans your website files when you share the issue with their support team. You will then receive an email containing a list of infected files and directories in a few hours.

Is DreamHost safe?

No, DreamHost is not safe. It has experienced a database leak recently. Among its clients, websites sharing cPanel on DreamHost are more vulnerable than isolated ones. If one site has an open port, a hacker can repeatedly use it to infect all sites.

Similarly, a shared hosting environment is also quite insecure. If a neighbor user blacklists the server IP, your domain will also be blacklisted.

Is DreamHost email safe?

No, DreamHost email is not safe. Shared hosting environments have poor spam protection in general, and DreamHost is not an exception. Expect a lot of spam when using shared hosting email services.

For better email security, choose a company specializing in email hosting.

What is the DreamHost data breach?

In April, 2021, DreamHost became a victim of a data breach. Emails and other records of 815 million users were leaked.

Is DreamShield protection worth it?

No, DreamShield protection is not worth buying. You will find many free and better-performing WordPress plugins for site security.