Do you always do admin operations over SSL (HTTPS)? That’s important, especially if you are using an unsecured wireless network such as many public-use 801.11 Wi-Fi access points are configured. Otherwise somebody can use a packet sniffer such as WireShark to intercept your login and then use it as their own later.

Ronald

Now in one site, all data have been deleted + database exploited
while in 2nd one, some files modified + database exploited

I followed every thing explained in Hardening WP (codex.wordpress.org/Hardening_WordPress… But nothing work.

Now i want to know:
How hackers got access my posts and database?
How can i protect my sites from hackers & any kind of unwanted users?
Mark

I’ve used CloudFlare free version, but not with the WordPress administrative interface. The free version doesn’t support SSL, at least not end-to-end with your own private certificates. I think the redirection problem you are having may be related to the way CloudFlare supports SSL. I also saw something like this trying it with the free version, hoping maybe it would pass through the SSL packets unchanged.

I’m just throwing out a guess here, but vaguely recall that you may have needed to get your SSL certificates from a CloudFlare partner company and you have to do something to configure CloudFlare to use them. However, this is a CloudFlare Pro feature that I have not used so is just a guess.

What I did to get around the CloudFlare free version conflict with SSL for security for administration features is to set up a host name for the web site in the /etc/hosts file (an equivalent is available on Windows machines, too) that directs the browser to the web site directly. This completely bypasses the CloudFlare system. This works great for many Linux, Windows, and Mac users, but may present problems on some other platforms, particularly mobile phones and tablet computers that don’t have an equivalent to the /etc/hosts file.

If you are using a platform that doesn’t have /etc/hosts or equivalent and have a Linux system somewhere on premises, you may be able to set up a domain name server to help you get the same effect of bypassing CloudFlare for your administrative uses.

Ronald