Title: Got hacked, plugins removed
Last modified: August 22, 2016

---

# Got hacked, plugins removed

 *  [SpiderKenny](https://wordpress.org/support/users/spiderkenny/)
 * (@spiderkenny)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/got-hacked-plugins-removed/)
 * This morning I found my site replaced with a hackers logo.
    At first it looked
   like just the index.html at the root of my site and index.php at the roor of 
   WP had been replaced, so I dropped a fresh copy from the original install package
   in place and my site was back up.
 * However I soon discovered that the admin password had been changed, and a lot
   of my plugins removed, including akismet, captcha and jetpack.
 * Thankfully they did not change the admin email address so I could re-set my password.
   
   I have re-installed my captcha and akismet plugins, but I had to remove the existing
   folders from wp-content/plugins
 * Do you think this was an FTP hack? Would that allow them to change the admin 
   password in WP?
    Or a password hack on WP? If so, how could they replace my index.
   php file? Or some other hack on WP, not related to stealing the password?
 * As a precaution I have now changed my FTP password and the Admin password in 
   WP.
    How can I check if they have installed any backdoors or other nasties on
   my site now?

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [Matt Knowles](https://wordpress.org/support/users/aestheticdesign/)
 * (@aestheticdesign)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/got-hacked-plugins-removed/#post-5448542)
 * Using FTP thoroughly go through your site looking for any files that were added
   or modified on the date of the hack.
 * Also take a look at your log files for both FTP and HTTP to see where they intruded
   from.
 * Hopefully you’ve already done the basics like delete the default admin user and
   use strong passwords.
 * I use two plugins that help prevent attacks that I like.
 * 1. **Rename wp-login.php** – This plugin changes the URL you use to login in 
   from yourdomain.com/wp-admin to something of your own choosing. This helps defeat
   most brute force login attempts because your login URL is known only to you.
 * 2. **Login Security Solution** – This plugin notifies you of brute force attacks
   and helps repel them or at least slow them down. Even after installing the first
   plugin I was getting notifications from LSS because now hackers are attacking
   WordPress through a file called xmlrpc.php. LSS helps protect that file.
 * I’ve been getting a large number of distributed attacks against xmlrpc.php the
   last couple of days after not having seen them for awhile. But they are all trying
   to log in with the username of admin, so it goes to show you that you should 
   always delete the admin user after setting up a new user with admin capability.
 *  [Matt Knowles](https://wordpress.org/support/users/aestheticdesign/)
 * (@aestheticdesign)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/got-hacked-plugins-removed/#post-5448543)
 * This article will give you more details:
 * [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked)
 *  Thread Starter [SpiderKenny](https://wordpress.org/support/users/spiderkenny/)
 * (@spiderkenny)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/got-hacked-plugins-removed/#post-5448631)
 * @MattKnowles
    Thanks for the helpful replies. Yes I’ve replaced the default admin
   user. I don’t have access to the FTP and HTTP logs, I don’t think. My site is
   hosted on EasySpace. As a precaution I changed the password for FTP and for my
   EasySpace control panel.
 * Thanks also for the suggested plugins, I will put them on right away.
    I had 
   a look through the wp folders, but I’m not really sure what is supposed to be
   there and what is not.
 * And finally, thanks for the link to the FAQ, I will go and read it now.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Got hacked, plugins removed’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 3 replies
 * 2 participants
 * Last reply from: [SpiderKenny](https://wordpress.org/support/users/spiderkenny/)
 * Last activity: [11 years, 6 months ago](https://wordpress.org/support/topic/got-hacked-plugins-removed/#post-5448631)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics