I was attacked from cache files.

Cached files were edited and change the pages to other site. I think should have checksum or something to verify the cache files has original generate from the plugin.