Important Security Fix for WordPress
The other day, my server crashed and Perishable Press was unable to connect to the MySQL database. Normally, when WordPress encounters a database error, it delivers a specific error message similar to the following:
![[ Screenshot: WP Default Database Error Page ]](https://perishablepress.com/wp/wp-content/images/2009/install-security/h4x0rd_03.gif "Error establishing a database connection")
Default database-error message
This customizable database error message explains the situation to visitors and circumvents any malicious activity involving exposed scripts, PHP errors, and other issues related to unexpected database issues.
That sounds nice, but there is a problem
The problem that I painfully discovered when my server crashed is that WordPress does not always display the default page for all database-related issues. Apparently, if the database is missing entirely, WordPress assumes that it has not yet been installed and loads the Installation Page:
![[ Screenshot: WP Installation Page ]](https://perishablepress.com/wp/wp-content/images/2009/install-security/h4x0rd_01.gif "WordPress Installation Welcome Page")
WordPress Installation Page
Yikes! This is exactly what happened when my server crashed, MySQL was unavailable, and the WordPress Installation Page was displayed to over 100 visitors while I scrambled to resolve the issue.
During the event, there were several attempts to assume control of my site through the Installation Page. Fortunately, I was working on the site (via FTP, cPanel, phpMyAdmin, and so on) during the attacks, and was able to terminate an inevitable hostile takeover.
“john@greatCampingTrips.com”, I’m staring at you here.
It happened to me, and it could happen to you
To me, this scenario represents an enormous security risk for all currently available versions of WordPress (up to 2.8 at the time of this writing). If WordPress serves up the Installation Page the next time your database goes down, anyone could easily gain full control of your entire server. By simply entering an email address and specifying a blog title, an attacker would administratively re-install WordPress and receive the following message:
![[ Screenshot: WP Installation Success ]](https://perishablepress.com/wp/wp-content/images/2009/install-security/h4x0rd_02.gif "WordPress Installation Success Message")
WordPress installation-success message
Ouch! This is no good. I was fortunate enough to have been there during the incident, however it could have happened while I was away from the computer. What if I had been asleep, at work, or on vacation? Trust me, it doesn’t take long for a savvy attacker to annihilate an entire server, and the damage may be irreversible.
A temporary solution, until WordPress does it better
After restoring full functionality to my site, deleting multiple “Hello world!” posts and “About” pages, and removing the newly added Administrator, it was time to prevent this situation from happening again. The easiest way to do this involves deleting, blocking, or modifying the wp-admin/install.php file, which contains the script that generates the Installation Page.
Until WordPress incorporates a better solution, I recommend one of the following three fixes:
Fix #1: Just nuke it
Simply delete the wp-admin/install.php file entirely. It is not needed after installation.
Fix #2: HTAccess to the rescue
Place the following slice of HTAccess into your site’s web-accessible root directory to prevent access to your install.php file:
# PROTECT install.php
<Files install.php>
Order Allow,Deny
Deny from all
Satisfy all
</Files>Fix #3: Replace it with something safe and useful
Replace the insecure version of the file with something secure and informative by following these quick steps:
- Rename the original
install.phpto something like, “install_DISABLED.php” or whatever. - Create a new file named “
install.php” and add the following code:
<?php // install.php replacement page: https://perishablepress.com/press/2009/05/05/important-security-fix-for-wordpress/ ?>
<?php header("HTTP/1.1 503 Service Temporarily Unavailable"); ?>
<?php header("Status 503 Service Temporarily Unavailable"); ?>
<?php header("Retry-After 3600"); // 60 minutes ?>
<?php mail("your@email.com", "Database Error", "There is a problem with teh database!"); ?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Error Establishing Database Connection</title>
</head>
<body>
<img src="images/wordpress-logo.png" />
<h1>Error Establishing Database Connection</h1>
<p>We are currently experiencing database issues. Please check back shortly. Thank you.</p>
</body>
</html>Once uploaded to your server, this new install.php file will prevent any malicious behavior by serving up a static web page. Now, instead of showing the Installation Page when your database is unavailable, WordPress will display the following message:
![[ Screenshot: WP Database Error ]](https://perishablepress.com/wp/wp-content/images/2009/install-security/h4x0rd_04.gif "WordPress installation replacement page")
WordPress installation replacement page
In addition to displaying this information to your visitors, the Installation Replacement Page also performs the following actions:
- Communicates a
503 (Service Temporarily Unavailable)status code to clients and search engines - Instructs clients and search engines to return after 60 minutes (configurable)
- Sends an email informing you of the situation so that you may take action
To use the Replacement Page, don’t forget to specify an email address in the fourth line. You may also change other variables, such as the time duration, email subject, or email message. If you need any help with these variables, please leave a comment. I have also made the Installation Replacement Page available for easy download:
Live long and prosper
Until the developers at WordPress implement a cleaner, more permanent solution for this issue, I highly recommend applying one of the solutions provided in this article. There is no reason to keep the original install.php file after you have installed WordPress, so feel free to delete, modify, or block it. Trust me, dealing with the trauma of watching your site get hijacked by some unscrupulous cracker whore just ain’t worth the pain.
Update
MustLive provides more insight into the install.php vulnerability via this comment and this article: Attack on Abuse of Functionality in WordPress. Many thanks to MustLive for his work on this security issue!
86 responses to “Important Security Fix for WordPress”
Good to know. Spreading the word.
thanks, Jeff. My blog was defaced among other things. I am deleting the install file on my other blogs. On the one that was defaced, I went with option 3 just because I like to pretend that I know code sometimes :-)
Aside from making those files inaccessible, I also make multiple daily backups of my blog. I have been hacked in the past, and if it were to ever happen again I can be back online in 15 minutes.
Hi Jeff,
I applied your fix #3, swapping the install.php file.
I enhanced the file to better understand where the attack can come from.
The new file can be downloaded at http://www.zialingua.com/ccount12/click.php?id=7
It is a .txt file. One needs to rename it as .php
Hi Zia, Thanks – I’m checking it out and will update the post soon. Looks awesome. Thanks :)
Great info! Really helps to secure the WordPress, default installation really doesn`t include way to prevent site from hacking if something goes wrong :(
I was looking for something o Google and stumbled upon such a site, “
wp-admin/install.php” was prompted. Naturally, I ran the installation and happily told my gf that I have a new domain. It was a pretty active website before, so I guess it won’t last long though…the truly miserable part of this story is that is has been doing it for years and has been reported by a multitude of dissatisfied punters………….even people u know seem to get a compelling urge to click install if they see that screen…………
Thanks for sharing such a precious information and making WordPress Healthy and Strong.
I applied your fix #3, swapping the install.php file.
I enhanced the file to better understand where the attack can come from.
The new file can be downloaded at the new link http://www.zialingua.com/rtfm/install.txt
It is a .txt file. One needs to rename it as .php
I tried downloading the replacement file. Says I don’t have access. I’m from Guam, you may have my request blocked or something. Just letting you know though. Don’t have to post this comment. Thanks, again. If anything, is this theme available somewhere? It’s just about exactly what I’d like on one of my sites.
Thanks for the heads up ketungo – the download should be working now :)