Someone dodgy just logged in as admin

I’m going through the LIVE View now and blocking IP’s Permanently.

What is this file that all dodgy people try to login via ?

xmlrpc.php

.waf file is already installed from Wordfence.

htaccess seems to have additional info in it, so I’m removing it entirely

HOW then can I get the script back on my new htaccess file that gets added when Wordfence enabled?

Thanks

I’m removing all cache plugins also and reinstalling them so there is no cache dodgy files

Hi @kristinubute, thanks for getting in touch.

It’s difficult to say an origin for certain as there can be factors outside of WordPress involved, but XML-RPC requests that you mention are one of the most common credential-stuffing methods used to attempt access to a site. Unless you’re using Jetpack or the WordPress app that require it, it can be useful to disable XML-RPC Authentication in Wordfence and possibly block that route altogether in .htaccess.

Any time we think someone’s site has been compromised, we tell them to update their passwords for their hosting control panel, FTP, other WordPress admin users, and database. Make sure to do this.

Even if you have complex unique passwords, and a non-predictable username for your admin accounts it can certainly be a helpful layer of security to have reCAPTCHA and/or 2FA enabled. Wordfence’s will work with the default WordPress and WooCommerce login/registration pages but there will be other solutions if you have custom pages, or ones created by a user management plugin.

There may be parts of .htaccess that are custom to your host or other plugins, so I can’t recommend deleting it outright as your password shouldn’t be exposed through it. Your host may reinstate it automatically if it’s missing and something there was required from their side, though. The code we typically add to .htaccess (if you’re not using .user.ini) is:

; Wordfence WAF
auto_prepend_file = '/your/path/to/wordfence-waf.php'
; END Wordfence WAF

The firewall will have been returned to “Basic Protection” if it can’t find that line though, so you could just go through the optimization wizard process again and the plugin will re-add to the files as appropriate.

As you mention removing a caching plugin, I did notice some false cache plugins were mentioned in the following article today: https://www.bleepingcomputer.com/news/security/over-6-000-wordpress-hacked-to-install-plugins-pushing-infostealers/

That may be unrelated to your case if you weren’t seeing fake Chrome errors, so don’t assume this as a diagnosis, but thought it was appropriate to mention after your comment above.

Don’t forget to remove any suspicious admin accounts if you see any, and the following documentation may help if you need to clean your site:
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
https://wordfence.com/learn/

Many thanks,
Peter.

• This reply was modified 1 month ago by wfpeter. Reason: Added cleaning documentation links

HI Peter

Thanks for your quick reply.

So I have removed an additional plugin that is not supposed to be there (dodgy)

I removed the administrator login completely and added a new Admin user name and reset passwords.

I’ve removed all cache plugins.

I have scanned with your Wordfence software and removed any strange files (which wasn’t many).

Doing additional scanning with your plugin to check all. How did they manage to get the admin password login when I have Wordfence installed and waf also?

Here is copy of htaccess file … I might just add a new default one .. Maybe something is here is not right now I’m not sure?

The first section doesn’t look normal does it?

RewriteEngine On RewriteBase / RewriteRule ^index.php$ – [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] END WordPress BEGIN FRedirect_ErrorDocument The directives (lines) between “BEGIN FRedirect_ErrorDocument” and “END FRedirect_ErrorDocument” are dynamically generated, and should only be modified via WordPress filters. Any changes to the directives between these markers will be overwritten.

ErrorDocument 404 /index.php?error=404 END FRedirect_ErrorDocument Wordfence WAF

php_value auto_prepend_file ‘/home/public_html/domains.com.au/wordfence-waf.php’
php_value auto_prepend_file ‘/home/public_html/domain.com.au/wordfence-waf.php’
Require all denied Order deny,allow Deny from all END Wordfence WAF

Thanks

Could you also confirm what the security.txt file that keeps getting picked up in the SCANS that the dodgy people keep trying to find ?

and well-known/traffic-advice

Or is that a hidden file that when compromised causes issues? I am not familiar with that file?

Thanks