# Was my website hacked?

**URL:** <https://discourse.cakephp.org/t/was-my-website-hacked/11899>\
**Category:** Uncategorized\
**Created:** [February 24, 2024, 10:35pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899 "2024-02-24T22:35:31Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 24, 2024, 10:35pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/1 "2024-02-24T22:35:31Z")

</div>

![2024-02-24](https://canada1.discourse-cdn.com/flex029/uploads/cakephp/original/2X/9/996ad0a32eabf86746b507f115861cd2b77d4112.png)  
My website is showing the error template just like on the development server (localhost) and I don’t know how to fix it. Other than that, my website has other problems like users can’t register right now. Please find attached a screenshot which shows the dirty blonde error space underneath “Forgot Password” which should only show at localhost.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 24, 2024, 10:48pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/2 "2024-02-24T22:48:09Z")

</div>

I haven’t updated my CakePHP version to 5 yet. I’m currently running CakePHP version 4 and my XAMPP (localhost, development server) is using PHP 8.0.28. Maybe errors are appearing because my hosting company, bluehost, is running a more recent version of PHP and I need to update. I’m not sure.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 25, 2024, 12:22am UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/3 "2024-02-25T00:22:52Z")

</div>

I just logged into bluehost and I saw that my website is actually using PHP version 8.0 so I don’t think I need to upgrade. But maybe the older version of CakePHP is the problem?  
I changed config/app.php a couple of weeks ago and I overwrote the file on my production server. I changed the file so that it wouldn’t issue warnings when there were errors but I don’t know what other settings I may have overwritten.

---

<div class="post-metadata">

**Author:** ![shaan007](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/shaan007/32/2765_2.png) [@shaan007](https://discourse.cakephp.org/u/shaan007)\
**Post date:** [February 25, 2024, 10:31am UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/4 "2024-02-25T10:31:06Z")

</div>

config/app\_local.php

‘debug’ =\> filter\_var(env(‘DEBUG’, true), FILTER\_VALIDATE\_BOOLEAN),

replace true with false

no warning and errors displayed on screen

---

<div class="post-metadata">

**Author:** ![shaan007](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/shaan007/32/2765_2.png) [@shaan007](https://discourse.cakephp.org/u/shaan007)\
**Post date:** [February 25, 2024, 4:59pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/6 "2024-02-25T16:59:37Z")

</div>

first of all!! `Bluehost scanned my computer for malware a week ago` really bluehost scan your local computer?? I mean Bluehost is hosting so how & why they scan your system, how can they do that? and if they already done it all so may be they were suspicious(Hacker) not Bluehosters.

can you show your error or code?screenshots

can you open that project in local environment/localhost XAMPP/WAMP.  
please use linux OS for programming there is 0% chance to virus or hacking attacks and linux provide apache2 server.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 25, 2024, 5:34pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/7 "2024-02-25T17:34:32Z")

</div>

![2024-02-24 (1)](https://canada1.discourse-cdn.com/flex029/uploads/cakephp/original/2X/8/86d80db51783e5457d4cafaba2eff30f05426ee9.png)  
Hi shaan007. I mis-spoke myself. I meant to say bluehost scanned my shared serving environment for malware. I’m attaching a screenshot of the error for logging in but I don’t think there’s a problem with individual files; the whole serving environment seems to be damaged. And how does it help to use Linux as my localhost/development server? The hacking happened on the bluehost server and not my localhost.  
The reason I don’t think the the individual files are the problem is because I uploaded the template and controller for the login to my shared hosting environment and I still got an error even though all of the files worked on my localhost.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 25, 2024, 6:18pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/8 "2024-02-25T18:18:16Z")

</div>

It’s trying to create session files in `/var/cpanel/php/sessions/ea-php80`. Does that directory even exist? Does it have full access permissions for whatever user Apache is running as?

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 25, 2024, 6:47pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/9 "2024-02-25T18:47:40Z")

</div>

Thanks, Zuluru. I will take a look and then I will open a chat with bluehost.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 26, 2024, 2:36am UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/11 "2024-02-26T02:36:42Z")

</div>

You surely have a local copy of your site. Use FTP to download the version from the server to a different folder, then use `diff` (on Linux) or something like WinMerge (on Windows) to compare the two versions. Any differences (apart from logs, cache files, etc.) would be where a hack is present. If there are no such differences, then the problem is not a hack, but something in your code. Maybe not all your code is PHP8 compatible, for example, and the only problem is upgrading that.

---

<div class="post-metadata">

**Author:** ![shaan007](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/shaan007/32/2765_2.png) [@shaan007](https://discourse.cakephp.org/u/shaan007)\
**Post date:** [February 26, 2024, 4:31am UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/12 "2024-02-26T04:31:27Z")

</div>

it seems that some permissions and path config issue! ok so now you can try it with database session… create new table in database. You can find session table in **config/schema/sessions.sql** directory just copy that sql scheme and past it in database and create new session table then please open app.php file

```auto
Configure::write('Session', [
    'defaults' => 'php' //set here session
]);

replace php to database

```

now session save in database and its much sophisticated

---

<div class="post-metadata">

**Author:** ![shaan007](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/shaan007/32/2765_2.png) [@shaan007](https://discourse.cakephp.org/u/shaan007)\
**Post date:** [February 26, 2024, 4:45am UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/13 "2024-02-26T04:45:09Z")

</div>

please change permission 0755 to 0777. 0755 means anyone can read and write so its different sense in linux world, 0777 means execute file with read and write capability & now come toward the hacking!! so its not like hacking its just some PHP version issue or some miss-configuration issue… but if you seems that its hacking so please open you bluehost cakephp project look into all template files… is there any unusual code or any js code! but i am sure that’s not WEB ATTACK it just some server or php version issue may be

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 26, 2024, 7:20pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/14 "2024-02-26T19:20:25Z")

</div>

When I go to my website now I see the error page:  
Please replace templates/Pages/home.php with your own version or re-enable debug mode.  
Error: The requested address ‘/’ was not found on this server.  
I uploaded my local home.php but the error persisted.  
My localhost uses PHP version 8.0.28 and bluehost uses version 8.0 so I don’t think this should be a conflict. CakePHP 5.0 requires a minimum of PHP 8.1 so I assume version 4 is still provided for by my shared hosting account at bluehost. Bluehost has up to version 8.3 available so if I need to change to CakePHP 5 I can. I just don’t know for sure if an upgrade will solve the problem.

To shaan007, I don’t know why you think I should change 0755 permissions to 0777. I looked it up and found that  
777 - all can read/write/execute (full access).  
755 - owner can read/write/execute, group/others can read/execute.  
so 755 seems to be what is necessary.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [February 27, 2024, 6:43pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/15 "2024-02-27T18:43:31Z")

</div>

Hi Zuluru, I am using WinMerge to compare the files and am still going through them. It’s going to take a while.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [February 27, 2024, 10:57pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/16 "2024-02-27T22:57:15Z")

</div>

I would have thought it would take basically no time at all. I’d expect no differences at all between what you have locally and what you have on your server.

An similar alternate approach, if you are using git for managing your source and have command-line access on your Bluehost server, is to just do `git diff`.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [March 1, 2024, 5:14pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/17 "2024-03-01T17:14:38Z")

</div>

I kept getting error messages about not being able to start a session so I just changed to cake sessions in config/app.php:

```auto
    'Session' => [
        //'defaults' => 'php',
		'defaults' => 'cake',
    ],

```

and now it works.

---

<div class="post-metadata">

**Author:** ![makamo66](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/makamo66/32/2156_2.png) [@makamo66](https://discourse.cakephp.org/u/makamo66)\
**Post date:** [March 1, 2024, 6:28pm UTC](https://discourse.cakephp.org/t/was-my-website-hacked/11899/18 "2024-03-01T18:28:24Z")

</div>

It was working at first but then when I went to the home page I saw the error message: Please replace templates/Pages/home.php with your own version or re-enable debug mode. So I commented the following part out and then it worked, but this is just a temporary solution. Maybe I need to update my CakePHP version from 4 to 4.5.

```auto
/*
if (!Configure::read('debug')) :
    throw new NotFoundException(
        'Please replace templates/Pages/home.php with your own version or re-enable debug mode.'
    );
endif;
*/

```