0

Every once in a while, I see an email like this:

Someone (hopefully you) has used this email to register at  My Website

Username: ********* 

Password: *********



Thanks
My Website

I login to my site, and sure enough, my admin email has changed to the one mentioned in the email. I freaked out the first time I saw it. I thought someone was trying to take over my site or put spam or ads on it or something.

However, since then, I've been using "WP Persistent Login", which tells me which devices are logged into my site, and every time my admin email has changed, I don't see any devices logged into my account, except my own.

These might be registered users on my site, but I'm not entirely sure. I have around 1200 legit registered users and around 800 that I think are spam accounts. I'm not really sure how to get rid of them and not sure if the changed admin email is from one of those that already existed or if they popped up just to change my admin email.

Could this be happening by accident? What precautions should I take?

Edit:

I forgot to mention, these emails are not going to my account, they are being sent from my G Suite account, which is what my website sends from.

Improve this question
1

1 Answer 1

Reset to default
0

if your admin email changes, I suppose it's not a good signal, so it's very important understand why it's happening.

Some malware usually have this behaviours, so I think you can start from:

  • have you checked if your plugins, theme and WP core are updated to latest versions? if no - backup all and proceed with the updates;
  • try to check if some of the spam users you mentioned have an adminsitrative role.

Let us know, cheers.

Improve this answer
3
  • Plugins and theme are all up to date, and no spam users have admin priviledges. I find it the most odd that (it appears) the owner of the email isn't attempting to login to the account..it's just happening. One thing I only discovered after posting this is that, sometimes my email will change the admin email address once every few minutes for like 2 or 3 hours.
    – Christian
    Apr 6, 2020 at 14:15
  • I went ahead and deleted all of my users, banned all new registrations, and used a secondary source of legit users (people who had booked with me) to re-create the real ones. It wasn't a perfect matchup of users, and I'm missing probably 100-150 legit ones, but I at least know I've kicked all the spam bots out. But I have to re-open user registration in the next week or so. Now, I register users programmatically and have removed the registration page. It's possible (though unlikely) they found my script and that's how they're registering fake users
    – Christian
    Apr 6, 2020 at 14:21
  • But I can't find a reasonable explanation as to how they could be changing admin account info. Do you have any other suggestions? At some point in the next couple days, I will re-open registration and test plugins and my scripts one-by-one by shutting them off, but it will be a long process–probably longer than I can afford.
    – Christian
    Apr 6, 2020 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.