0

My WordPress website has been hacked. Google sent me an email stating that the site would be listed in browsers such as Google Chrome and display a warning when users visit or download certain files from your site. I checked the server and found a bunch of folders with random characters and files that are not part of wordpress core files like add-admin.php. I uploaded a clean copy of the website from my local pc, then I installed iTheme Security plugin. I also changed the admin password in wordpress and changed the root pw to the server.

Luckily, nothing malicious has been done. It looks like they are using the server to store files for sharing. As of now, there is a folder named networkl in the root directory, I have deleted the folder but it always reappears in less than 5 minutes. At this point I'm not sure what to do.

Improve this question
2
  • There's lots to do to clean a site. Change all credentials (host, database, ftp, admin) with strong passwords. Update everything. Delete plugins folders and reinstall via FTP (download from repository, unpack, delete all files in plugin folder, re-upload via FTP/SFTP). Do the same with themes. Don't deactivate, as your settings might go away. Look at the wp-posts table for content that isn't valid (usually later rows). Look at all php files for inserted code. Datestamps sometimes help, but not always. Make sure wp-config/wp-settings file is clean. Check htaccess. (more)
    – Rick Hellewell
    Nov 12, 2019 at 23:56
  • Remove unused themes/plugsin. Only install themes/plugins from the WP repository.I use this procedure: securitydawg.com/recovering-from-a-hacked-wordpress-site .
    – Rick Hellewell
    Nov 12, 2019 at 23:57

0

Reset to default

Browse other questions tagged or ask your own question.