Site hacked, all cleaned now, but…

  • Hi,
    My site has been hacked a while ago and hackers did a mess on it. Changed the theme, logged me out of the site, created fake posts and etc…

    I managed to clean it up, buy doing the basic security measures. However, every now and then random posts appear out of the blue.

    These posts have no author attributed to them. I checked the database using phpmyadmin and there doesn’t seem to be any other user rather the admin one.

    Any idea of where those posts might be coming from?

Viewing 7 replies - 1 through 7 (of 7 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    You probably left a backdoor open when you tried to clean the site.

    Did you install WordFence and do a High Sensitivity scan on your site?

    @nandorj78 I assume you changed all of your passwords as well?

    Thread Starter nandorj78

    (@nandorj78)

    Yes for both questions above. Postings keep being posted. They are all uncategorized and have no authors attributed to them.

    I still don’t know what to do.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter nandorj78

    (@nandorj78)

    Steve,
    I’ve already done that (followed those links) before I opened this thread.

    By doing what is recommended I managed to fix the website, managed to avoid the hackers messing with the template, creating fake files and things like that.

    The only thing I could not fix was this issue of random ghost posts. I wonder how it’s even possible to post things without having a post author at all.

    What then was the cause of the original attack, that allowed an attacker to edit templates, add files etc?

    Thread Starter nandorj78

    (@nandorj78)

    No idea what the cause was. I simply applied all the measures suggested.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Site hacked, all cleaned now, but…’ is closed to new replies.