Posts disappearing

1) Are the posts still in the DB? Use your web host’s backend– phpmyadmin, for example– to browse the DB directly. If your posts are there, backup immediately.
2) Also look in your WP directories for files you don’t recognize– compare to a fresh WP download.
3) Disable your plugins and see what happens.
4) Ask you web host if this server has had any trouble.
5) Start thinking about a fresh install.

Thanks ??

Is there any chance they’re getting in through a plugin? I’ve just been hacked yet again and they’ve deleted 50 posts I posted this week and uploaded and activated about 100 plugins.

Well, dannster… that hacking problem seems to be your problem.

Save everything– files and DB. Then delete everything and reinstall from a fresh download of WP. Do not re-upload anything from the infected site– no plugins, no themes, nothing. Only re-upload copies you know are clean. Get fresh ones if you can. The DB could possibly be trouble. Once you import the old DB, you need to check every user that has signed up and make sure that nobody but you has admin power. I guess you could try this first and maybe avoid a reinstall, but its risky. After that type ‘harden wordpress’ into Google.

Thanks ??

I’ve pretty much had to re-install everything and somehow managed to recover about 50 posts from old backups, so I feel quite happy right now!!

I changed the theme (just for my own sanity), ensured all the files and directories have the right permissions and all the rest of it. But my final step is checking if there are any other users with admin status and there is! It says there’s 2 Admins in the blog CP but it doesn’t show the other admin, I had to go into the DB to find it and it’s showing as username WordPress! Is this the hacker? Maybe he’s used that username to try fool me it’s legit?

If it’s him then this could be how he’s managed to keep getting in.

Just to add, I deleted user ‘WordPress’ and it was the admin account, so must have been the hacker!! ??

Yep, ‘WordPress’ probably was the hacker. The only thing to worry about now is, how did the hacker get in the first time?

I agree, I’ve tried my best to find vulnerabilities and after the first attack I noticed I had the wrong permissions on many of my directories and files. However, I thought after this he must have been getting in another way, but clearly he’d just been getting back in with his admin access!!! lol

I’ve become really paranoid now, I changed the theme just incase that was the cause of any vulnerability.

If there’s one thing I’e learn’t from this it’s to backup every night! Many thanks for all your help ??