My Yii Site Got Hacked: Lessons Learned and How to Protect Your Web App

Recently, I experienced a nightmare scenario: my Yii-based website got hacked. Fortunately, this became a learning opportunity, and I want to share both what happened and how to protect your Yii applications.

How It Happened

The attacker exploited an unpatched vulnerability in a third-party Yii extension I was using. They gained access to the database and inserted malicious code into some PHP files.

Common entry points in Yii apps:

Outdated composer packages

• Weak console/config permissions
• Unvalidated input in custom controllers
• File upload handlers without proper checks

Step 1: Detecting the Breach

Signs of a compromised Yii site:

# Unexpected new files or changes
find . -type f -mtime -7

# Suspicious admin logins
SELECT * FROM user_log WHERE ip_address NOT IN ('your office IP');

Check web/assets and runtime folders for PHP files that shouldn’t be there. Yii often stores cached templates, and attackers sometimes plant backdoors there.

Step 2: Isolate and Recover

1. Put the site in maintenance mode:

// web/index.php
defined('YII_DEBUG') or define('YII_DEBUG', true);
defined('YII_ENV') or define('YII_ENV', 'dev');

1. Backup the current database and code — even if compromised, you may need logs for investigation.
2. Restore from a clean backup if possible.

Step 3: Remove Malicious Code

Example: scanning PHP files for eval or base64_decode injections:

grep -r --include="*.php" "eval(" .
grep -r --include="*.php" "base64_decode(" .

Manually review suspicious files — automated removal may break your app.

Step 4: Patch and Harden Yii

1. Update Yii and all Composer packages:

composer update --with-dependencies

1. Secure file uploads:

// In your controller action
$uploadedFile = UploadedFile::getInstance($model, 'file');
if ($uploadedFile->extension !== 'jpg' && $uploadedFile->extension !== 'png') {
    throw new \yii\web\BadRequestHttpException('Invalid file type');
}
$uploadedFile->saveAs('uploads/' . $uploadedFile->name);

1. Enable CSRF and input validation:

'request' => [
    'cookieValidationKey' => 'your-unique-key',
    'enableCsrfValidation' => true,
],

1. Set proper folder permissions:

chmod 755 web/assets
chmod 755 runtime

1. Monitor logs:

tail -f runtime/logs/app.log

Step 5: Learn and Automate

• Regularly run vulnerability scans: OWASP ZAP
• Automate backups of both DB and code
• Use a firewall (e.g., Cloudflare or nginx rules)

Key Takeaways

1. Backups are your best friend. Always keep recent backups offline.
2. Keep dependencies up-to-date. Even minor Yii extensions can be exploited.
3. Validate everything. User input, uploads, and forms.
4. Logs are gold. They help trace what the attacker did.
5. Security is ongoing. Treat it as part of your development lifecycle, not an afterthought.

Conclusion

Getting hacked is scary, but it’s also an opportunity to strengthen your application. After following these steps, my Yii site is now secure, monitored, and hardened against future attacks.

Remember: prevention is always better than recovery.