silky

No, I didn’t add CloudFlare, and plus I contacted my host to verify that they did not change/move anything.

Yes, those items have been marked from the beginning. I also had the feature block attempts to get usernames using that author url. Still, they got the username and tried to sign in (hard to believe that could be a bot). I don’t use admin, and my username is obscure. Attempts were also made using ‘administrator’ by an ip in Australia. (I’m referring to the domain where no email was sent)

I had another domain that I forgot to install Wordfence on until yesterday. I couldn’t even sign on. So I had to go to my host to change the password. Today, Wordfence emailed me that someone had tried to sign in using Admin and requested an email to change the password. Wordfence blocked that, and I have since put a permanent block on the ip. So that’s good. Thing is, I did a site check through Google and discovered that over a 100 pages had been added for viagra and other stuff. (but that probably happened before I installed Wordfence) I don’t think I’m dealing with a bot, because I’ve been plaqued with attacks by the same ip out of Ukraine, which I have blocked on all my sites using Wordfence. But goodness, this person(s) is persistent and it’s exhausting trying to stay ahead. I did run another scan, but Wordfence didn’t note any changes to the pages, and it said all was fine. But would that be true in the case of url injection?

By the way, I really appreciate your quick responses.

I got a message from this one domain that Wordfence needed to be updated even though I had it set to update automatically. I got nothing regarding the attempts to login, and there were many.

Why on earth would a bot be trying to log in? Isn’t that a bad thing?

Just a note…the only plugin I’m using on the site is Wordfence, and the hacker has really been trying to get at the plugin folder. I suspect they are looking for some vulnerability in the plugin.

The test email came through with no problem. So that wasn’t the issue.

As for my username, I have an ‘under maintenance’ plugin in use. Plus, I’ve tried various recommendations to protect my username, such as posting under a different username and not the admin name. It’s just all so creepy.

Thank you. I had been searching on Google for information. Now I’m trying to find it on my computer. I wonder why my virus protection didn’t find it. But thank you for being so proactive about my question.