Hi @johnw63, thanks for getting in touch and sorry to hear of the trouble you had with your site.
Your description of the issue does sound like the attack vector was still open. Whether that’s an admin account created by the attacker that was still available, plugin vulnerability, or access through some other means (database, hosting control panel etc.) is difficult for me to say from this position and be 100% certain.
I would recommend going through our site cleaning checklist and seeing if anything was possibly missed. Some of the below will naturally cover passwords that you may have already changed, if the cause of this latest breach is not immediately apparent to you then you may unfortunately need to change them again.
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
Make sure to get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here:
https://wordpress.org/download/releases/
WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.
As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure to do this.
Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.
If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers one and there are others. Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand.
Thanks,
Peter.
Since the hacker used one of my email accounts as the email for their admin account, I suspect it might have been that. I’ve changed every password I’ve found and deleted accounts that I don’t need any longer.
Since I only use WordPress for my front page, I think I’m just going to blow it up and start from scratch. I was really liking the reports from Wordfence and the 2FA part. Just really surprised I got hit again.
Hi @johnw63,
Thank-you for the update. Site breaches using an account that may have been compromized before can occur despite the presence of Wordfence. We and WordPress themselves recommend 2FA and reCAPTCHA on all accounts with administrative access for maximum security going forward. Other than that, just make sure no other accounts present look suspicious.
Provided the attacker can’t access again using a non-WordPress route, clearing the site altogether is certainly an option with a smaller installation like yours but the cleaning instructions should help, should you decide to continue with your exising site.
Thanks again,
Peter.
Well, Peter.
I decided to go all out and deleted the WP folder and the WP database and started over. PHP is up to 8.0 and got WP reinstalled. I installed WordFence again to have 2FA
2 days later… my admin login is changed again to a version of “AnonymousFox”. I’ve changed the admin login name and used a randomized password when I reinstalled. No alert from WordFence to my email.
I’m starting to wonder if keeping my WP front page is worth it.
I’ve changed to using secure FTP. I’ve removed unneeded database and back-end user accounts. I’ve changed all the passwords of my personal e-mail as well as the site emails. I stopped using a gmail account that was suspicious and made a new one. I’ve deleted the WP folder and database and started new. I installed WordFence right off and left the WP install alone, just to see what happens. After a few days the admin account is edited. There must be a log I can see that shows WP database activity that I can use to track down how this change occurs.
What change logs are available in the WP database or the phpmysql screens provided by hosts?
Hi @johnw63, thank-you for the extra information.
This is turning into a pretty tough one as it seems on the face of things like you’ve been extremely thorough in your investigation and attempts to secure any ways into your site.
We’ve noticed your mention of AnonymousFox. We wrote a post about it being used on a host to infect users across shared servers last year:
https://www.wordfence.com/blog/2021/06/service-vulnerabilities-shared-hosting-symlink-security-issue-still-widely-exploited-on-unpatched-servers/
This seems like a lead worth exploring, and may not be the cause, but there is a chance your host has a misconfiguration that allows reinfection on your site from another customer’s site on the same server.
It might be worth checking in with their support channels as looking at logs across all accounts – which you won’t personally be able to see – could point to another site on the same server that might be causing it.
Thanks again,
Peter.
@johnw63 Additional information:
Sometimes the web server logs can give evidence like catching the referrer from another site on the same server, sometimes the malware or if symlink files exist in the site those can provide evidence. Only your hosting provider would have access to MySQL authentication logs.
Besides all the routine WordPress admin, FTP, SSH, cPanel user passwords:
- Changing your MySQL password is critical. Make sure remote MySQL access from all connections is not enabled.
- Most critical may be changing wp-config.php to
600 permissions. This is preventative against the symlink vulnerability mentioned in my above post that exposes that file to be read in default permissions, which allows direct access to the db from other infected sites on the server.
- Your default cPanel password should also be changed if you haven’t already. There’s a common account third-party billing panel out there called “WHMCS”, where the cPanel password is controlled from the account billing panel. Your host may be able to help with finding this if it’s not apparent whether it’s changed from within cPanel or that kind of external billing dashboard provided by your host.
Thanks again!
