wordpress blog hacked.. help required

[swordfish]

Guys, today morning when I tried to log in to dashboard of my newly created blog, I was not able to log in. then I thought that it might be because of yest day's drink and I might have changed it but then i tried to recover my password and to my surprize there was no user in wp-users table !!!
I created one and login finally.
I checked a draft post saying that "Defaced By D(R40L)Z" with some f*cking algeria flag.

How could have he done that? I checked wp-config.php file with some strange password and as he was able to log in to data base with this pass that means he has access to database !!

guys I need your help to secure the blog.

Here many people have blogs since long time so they might have idea redarding this..

First question is what permission should be applied to all files in webserver?
Second, how to secure database ?

PS : I dont know if this is correct forum to post? I didnt find specific forum for this kind of discussion

 

[thewisecrab]

Your first step should be contacting the support team of your web host, see what they say/can do

 

[swordfish]

Ok.. I will do..
what permission do you keep for your files? eg 755 or 644 or ?? If i restrict the premissions then web server cant read the site at all..

 

[adi007]

First restore old backup of the site if available
Second install wordpress security check plugin and do all the things that it says
third protect your wp-admin directory using .htaccess .. use google to know how ..
fourth google for wordpress security and browse some tutorials .. i personally like the wordpress docs entry about this