Wordpress Sites Hacked

Ok, as a reseller some of those questions will not apply to you directly. If you've got ssh, it's jailed, but most likely it's not enabled unless you request ssh access.

For your wp-config file, move it to the root directory of the user, so up one level from public_html. Leave the wp-config.php file in the public_html, create another file up one directory and call it wpconfiguration.php or something like that. Use an include in the original wp-config file to include the one you created. Put the include in place of the database information. Also, since your sites were compromised, you should change the database password, AND remove and create a new user. Put the details in the new configuration file.

For backups - don't rely solely on the hosts backups, always keep your own backups. I have a web hosting company, based on multiple servers/locations and use multiple methods of backing up. Since you don't have root access, your options are limited. I would recommend Backomatic, since it's easy to use and you can automate it. Works well with whm too.

For lockout, you could use login lockdown, but I'm not sure if it will conflict with bullet proof. This will aid against brute force attacks.

You need to do some research on .htaccess options:

This will deny all access to the config file: (use this in conjunction with using a "real" configuration file that is up one level)

# to protect wp-config.php
<Files wp-config.php>
order allow,deny
deny from all
</Files>


This will deny all access to the .htaccess file:

# to protect the .htaccess file itself:
<Files .htaccess>
order deny,allow
deny from all
</Files>


Hope this info helps!