gilbodavid

thank you Elisa. i shall do all that with my hosting provider

i had about 20 count failures and then they were in. I don’t think they got in by getting my password correctly

And on all my sites, i set it to 20 log-in attempts then lock out

Thank you for your replies!

Ive had WF for a while, strong password, non generic name, all plugins up to date, wordpress automatically up to date, Duo cell phone authentication.

I use very few plug-ins. Just the best known ones, like Meta Slider, Yoast and WF!!

My webhost is trying to work it out now.

They got in very easily.

Paswword was strong. I had wordfence free, duo cell phone autharisation, and /wp-admin name changing plugin.

What I want to know is how they got past it, and so easily!!!!

Actually they can get in. Ive just had it happen to me. They’ve got in past wordfence, duo and /wp-admin changing plugin, and are presently doing what they like in my main site. Nightmare