xtiana

Thanks! Fortunately we don’t really use the blog anymore – I didn’t think those were existing posts but maybe so. I deleted them all and that was no big deal. Any idea why it would have taken until today (we updated WP back on 3/13 and have been on SiteLock for a few weeks now, I believe) to notice the page defacement? We assumed it was a new hack just because we didn’t know about it until today.

Thanks so much for the quick response! Sadly only the original designers have access to FTP or the Cpanel (with PHP MyAdmin, file manager, and that whole enchilada). We tried contacting the hosting company but even the passwords, security verification questions, billing info are all mysteries to us. They’re all handled by the third-party designers.

It looks like because the code I was adding contained a getsource() function, I may have tried to install that in two PHP files and caused a conflict. We may just have to wait until next week when we can reach the original design firm, but I just wanted to see if there were any other ways to edit WP PHP files with just the general WP credentials. Let me know if you think of any other tricks! Thanks again.

And now the site seems to have miraculously reappeared, apparently with no help from our web hosts. Any advice as to why this kind of thing might happen and how to prevent it from happening again would be much appreciated. Thank you!

• This reply was modified 8 years, 6 months ago by xtiana.

(Side note, we did change our passwords last weekend, immediately after being notified of the suspicious files. They’re long/complex passwords. We haven’t been logging in over any public wifi networks or anything, so I don’t necessarily suspect malware. Our host did re-scan everything and found nothing suspicious back on 8/28 after we deleted the files they had flagged.)

• This reply was modified 8 years, 6 months ago by xtiana.

Solved via email, thank you!

The URL for the test site is currently https://uwajimaya-merchants.org/2016 – or try without the /2016 if that doesn’t work (we’re supposed to make it live this afternoon). Thanks!