Often people ask me how important is it to upgrade your WordPress blog or CMS if its 3 or 4 versions out of date? Well its very important! Not only are you missing on great new added features to the system but also expose yourself to less security threats. In the last few days a number of big WordPress blogs have being hacked. Most of the back-doors done by the hackers who are often the guys that are aware of these flaws in older versions of WordPress. Most common hack they do is to add malicious code to the index.php file ( like a iframe redirecting traffic to there ad revenue sites).

If you’ve been hacked

1. Upgrade to the latest version of WordPress.
2. Make sure there are no backdoors or malicious code left on your system. This will be in the form of scripts left by the hacker, or modifications to existing files. Check your theme files too.
3. change FTP config permissions to 644
4. Change your passwords after upgrading and make sure the hacker didn’t create another user.
5. Edit your wp-config.php and change or create the SECRET_KEY definition. It should look like this, but do not use the same key or it won’t be very secret, will it?

Check your .htaccess file in the root of you blog. A simple version of it should look like this:

PS. If your site has been hacked, try the WordPress Exploit Scanner which will try to find any modified files and suspicious database records.