friendlygiraffe

hmmm that stille didn’t work. Here is my code – it’s a single-post template

[code moderated - please use the pastebin for any code over the forum limit of 10 lines]

Thanks. That seems to add a number when you publish or create a post, but not the sequence number of the post in that particular category

Ok thanks

Manual update worked. Sorted. Thanks

Thanks Matty, i cannot view the dashboard (/wp-admin) as is just displays that error

Well no more hacks now for a while. Turns out it was a series of .htaccess files. I think they were accessing it through an insecure stagnant wordpress site ( I neglected to update it) which was listed as dangerous by google.

The plug-in ‘WordPress file monitor’ was very helpful in getting to the bottom of this. I would recommend it

root path of my server. So it is above all my website’s directories

The .htaccess files they have modified have a load of line-returns, so I didn’t bother noticing the scrollbar.

I’ve deleted the rouge code off the htaccess files, but they get edited again the next day, so the spammers have access to the server, despite me changing the ftp passwords

The ‘WordPress File Monitor’ plug-in has been really handy in notifying me of this, I would highly recommend getting it

As for the exploit scanner, I guess it isn’t as good as I thought. It’s picking up possible threats in the plu-ins that aren’t as severe as I thought. I’ve compared the old plug-in with fresh ones and they match

i’m not convinced it’s that plug-in yet. I think I found the culprit, a rogue htaccess file in the servers root

Had a bit of progress

It seems the key to this is the Exploit Scanner plug-in, when I finally got it to work (the site kept redirecting during scans) it showed the most severe notifications inside the plug-ins folder, mainly the phpMyAdmin plug in.

I have deleted the phpMyAdmin plug-in and so far so good

Ok I’ll give Compare another go

I just ran Exploit Scanner (which worked this time) and it’s come up with so many errors I don’t know where you start

base64_decode is flagged a lot

Contacted my server provider who said it was a htaccess file, but I’ve not seen any changes on it, in face I’ve deleted it completely

Hi Pete – I did a ‘beyond Compare’ last night, and pretty much all the files came up as red (not matching) though I could have missed something

Exploit Scanner still not working, but will give it another try

thanks!

Ok I have removed the htaccess completely and it’s still redirecting. must be a database hack then. I might delete everything and start from scratch

Thanks I had a look through those

I have replaced the .htaccess file with your suggested code, the site is still redirecting, so I assume it is not the htaccess file?

i will try beyond compare tonight

I have now

I have also used the ‘Inactive users deleter’ plug in to delete hundreds of fake registrations