Support » Plugin: Sucuri Security - Auditing, Malware Scanner and Security Hardening » disabled and removed plug-in but still recieve messages

Viewing 10 replies - 1 through 10 (of 10 total)
  • @damnsharp Did you remove the actual directory from /wp-content/plugins/ ?

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    Thanks for reply @g0tr00t ! I will check that and will let you know tomorrow (better wait a day) if that helped.

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    Hi support, still getting the mails. What more can be done?
    I changed the company name and user name to website-name/user-name. Rest is the same.

    Strangly enough the ip address of the website url is different than in the mail.

    Mail looks like this:
    Van: Youngster <noreply@testmail.com>
    Verzonden: donderdag 16 april 2020 10:03
    Aan: info@website-name.nl
    Onderwerp: Sucuri Alert, http://www.website-name.nl, Failed Login

    Event: Failed Login
    Website: http://www.website-name.nl
    IP Address: 50.62.177.107
    Date/Time: 16 april 2020 10:02

    Message: User authentication failed: user-name; password: FailedLoginFooter

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    @g0tr00t do you know what the problem can be? Thanks!

    @damnsharp Were you able to verify that the directory /wp-content/plugins/sucuri-scanner/ was removed?

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    @g0tr00t yes

    @damnsharp It sounds like the uninstall of the plugin was not successful and so there are database entries that are still existing. The easiest way to fix this would be to re-install the plugin through wp-admin and then deactivate it and remove it through the wp-admin interface.

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    @g0tr00t thanks, I tried that before but I can try that again.
    Still puzzles me the wrong IP address… do you have a clue?

    @damnsharp Was the website transferred to a different hosting location? It’s possible that the WP installation still exists on the old host which is why it would show a different IP address for the website. If you are able to view the full email headers of the alert email then it should show the server used to send out the email. Look in the Received: field of the email headers for its source 🙂

    Thread Starter Damiaan van Vliet

    (@damnsharp)

    Yes, that’s the only possibility now. Thanks!

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘disabled and removed plug-in but still recieve messages’ is closed to new replies.