gschaefer

Any update on the ETA for this @bsfaradhy ?

Yes I want to create a welcome page that only loads the first time for each visitor.

I found a way to do it using the Elementor Pro plugin by creating a full screen pop-up. The controls built into the Elementor popups allow for session control and a wide range of other options so problem solved. And the best bit about this method is I can use the elementor editor to design the welcome page.

How did you resolve this? I am seeing the same issue appear on multiple WordPress sites and even after removing the infected files and replacing them with the original versions, the next day they are hacked again. I am running Wordfence and Securi both in a hardened state on a very secure private linux web server account so i’d love to know how this is happening?

i found it in on a clients website, it was the Mynt Mobile theme.

luckily it was an old website and cpanel account we are taking down anyway so no harm done this time. I have seen plenty of other functions.php hacks with malicious code before like social.png but not that snippet before. Seems like a new and potentially more harmful variety. It looks like it gives the remote user admin access to me.

PS; sorry for posting the code snippet, but thought the admins might like a copy.

When I set the CF7 form and mail fields according to this thread using my own domain email in the from field and the Reply-To: [your-name] <[your-email]> in the additional headers field I receive the email correctly with no validation errors.

When I reply to the email in Outlook/Mailbird email apps I get this error

missing_mailbox@syntax_error

This would indicate the PHP code in CF7 is not formatting the reply to field properly. PS: Am using CF7 4.4

I followed all the advice exactly.

i added Reply-To: [your-email] to the additional headers but it still says the email is from WordPress and replies go to my email??

if you sent the from field to [your-name] <[your-email]> it gives the error ‘This email address does not belong to the same domain as the site.’ when you save the form.

If you set it as your own domain email it works but the email is from wordpress. This really sux bigtime and needs to be fixed urgently.

if you set the from field to [your-name] <[your-email]> it gives the error ‘This email address does not belong to the same domain as the site.’ when you save the form.

If you set it as your own domain email it works but the email is from wordpress. This really sux bigtime and needs to be fixed urgently.

UPDATE: i added Reply-To: [your-email] to the additional headers but it still says the email is from WordPress and replies go to my email??

i have the same problem but not using Limit Login Attempts plugin.

It redirects to the home page after login not the admin dashboard.

This is my new htaccess file it created

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ – [L]
RewriteRule ^securelogin/?$ /wp-login.php [QSA,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

me too i can’t work this out at all..
it works on all my other websites

did you work out how to do this, as I can’t see how it can be done..

jquery maybe ?

i had exported my posts and pages from WordPress admin using the default import/export plugin them before i torched my infected site.

Ask your web host to explain how to isolate a website, will depend on your hosting account etc.

yes and I moved the domain to its own cpanel account as well and started from scratch again by installing a clean copy of WordPress and re-installing all the same plugins and widgets and imported my posts and pages but had to do all the rest manually..it took me 2 solid days !! Thankfully i had saved all my CSS changes to my theme !!

I also installed the WP Better Security plugin and followed ALL their recommendations and did a few other things on my hosting account as well with the help of my ISP.

https://bit51.com/software/better-wp-security/

So far so good and no signs of the same hacking problems.

OK fair enough and these are good reasons so thanks for explaining the logic behind them..will try to follow this in future.

In regards to this problem do any of the other affected users have a plugin called ‘Special Recent Posts Pro’ installed ?

i don’t understand why the moderators are saying post to another topic..it’s exactly the same problem everyone is having (My website redirects to Braffic.com & Motometalrims.org?) so isn’t it better to keep the conversation to this thread ?

P:S Securi and other malware checks did not detect it