Website hack

  • Andrew Leonard

    (@andrewleonard)


    4 days, 2 hours ago

    I got this email warning from Wordfence:

    A user with username “username removed” who has administrator access signed in to your WordPress site.
    User IP: 179.60.149.104
    User hostname: 179.60.149.104
    User location: Managua, Nicaragua

    I then got this email warning from Wordfence:

    A user with username “username removed” deactivated Wordfence on your WordPress site.
    User IP: 179.60.149.104
    User hostname: 179.60.149.104
    User location: Managua, Nicaragua

    The username was correct (I have removed it) but I live in the UK. I do not know how they found my password – it was a “strong” password suggested by WordPress, 15 randon digits.

    They managed to hack my site so the home page showe a fake Cloudfare screen instructing the users to “prove their credentials” by going through a process which would download a malicious file onto their computer. I could not access any page on my website and I could not login to the control panel

    The way that I found to restore my website was to rename the Wordfence file in the plugins folder using Filezilla. So the malicious code was “hidden” in the Wordfence folder.

    When I regained control I found that there was an update to Wordfence which I installed. My website seems to be working OK now

    I have changed passwords and am now using 2FA

    Has anybody else suffered from this hack?

    Have I done enough to subvert it or am i still vulnerable?

    The page I need help with: [log in to see the link]

Viewing 1 replies (of 1 total)
  • Plugin Support wfpeter

    (@wfpeter)

    3 days, 2 hours ago

    Hi @andrewleonard, sorry to see that happened to you.

    Wordfence is an endpoint firewall that runs after PHP loads, so an external attack vector could have been used initially before the user logged in successfully through the site. Databases, hosting control panels, and FTP can all be accessed without loading your site with Wordfence involved. Try to protect all admin accounts with long, complex passwords and 2FA wherever it’s available.

    We always recommend that you make a full backup of the site before making any changes. After this, make sure to remove any suspicious users with administrative access as a priority. That’s just in case they’ve created a new account to retain access to your site. I see you’ve already made changes to the original account affected by this.

    We also advise you to update your passwords for your hosting control panel, FTP,  WordPress admin users, and database. Make sure to do this.

    Over half of all login attempts that are made on WordPress sites are made via xmlrpc.php. Wordfence offers the option to block XML-RPC or at least require 2FA with authentication requests using XML-RPC on the Login Security > Settings page. You can also block it entirely using .htaccess so long as you don’t use the WordPress app or the JetPack plugin, which require access to it.

    I will provide our site cleaning instructions for you below, which may be useful to check even if you don’t suspect anything other than the user to be affected:
    https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

    Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.

    I hope that helps you out!
    Peter.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.