Title: Possible Hack Last modified: August 22, 2016 --- # Possible Hack * [Chris](https://wordpress.org/support/users/chris_bswish/) * (@chris_bswish) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/) * Hi, * Over the past week I have been noticing foreign files appearing in my public_html folder. They are being placed at the same time every night, making me assume that it is a simple injection by a bot. I have updated the whole system and did a lot of cleaning up but yet the files keep returning. I have done numerous scans to make sure there was no malware on our site or VPN, luckily those results came back negative every time. I was hoping that someone else might be experience the same thing and could help. * Here is one of the codes from the foreign files: _ [hacked code removed- please don’t post that here] Viewing 6 replies - 1 through 6 (of 6 total) * Moderator [t-p](https://wordpress.org/support/users/t-p/) * (@t-p) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568705) * You need to start working your way through these resources: * How to clean and fix hacked WP blog: [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked) [http://wordpress.org/support/topic/268083#post-1065779](http://wordpress.org/support/topic/268083#post-1065779) [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/) [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/) [http://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/](http://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/) [http://sakinshrestha.com/wordpress/fix-if-your-wordpress-site-is-hacked/](http://sakinshrestha.com/wordpress/fix-if-your-wordpress-site-is-hacked/) [http://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/](http://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/) * Harden your WP installation: [http://codex.wordpress.org/Hardening_WordPress](http://codex.wordpress.org/Hardening_WordPress) * Additional Resources: [http://sitecheck.sucuri.net/scanner/](http://sitecheck.sucuri.net/scanner/) [http://www.unmaskparasites.com/](http://www.unmaskparasites.com/) [http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html](http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html) * [The Hack Repair Guy](https://wordpress.org/support/users/tvcnet/) * (@tvcnet) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568714) * This is sadly relatively common. It means your account has been compromised, be it through a guessed at password, or possibly an outdated version of something which hackers have found and are exploiting for their own nefarious ends. * There is no instant fix. Your website files will need to be gone over “with a fine-tooth comb” and cleaned up to return your service back to clean and shiny self. * Thread Starter [Chris](https://wordpress.org/support/users/chris_bswish/) * (@chris_bswish) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568728) * Thank you Tara and The Hack Repair Guy for the responses! * Is there any tips or tricks that might help me target a general area to focus on? I was going to attempt to start the process of elimination with the plugins, disabling them one at a time and seeing if it will occur again. * The site is pretty large and complex, it would take days to comb through it all. * I am really regretting not making a backup closer to the hack date * [The Hack Repair Guy](https://wordpress.org/support/users/tvcnet/) * (@tvcnet) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568731) * Much like bringing your car into the shop for repair. We can hear the noise, but without popping the hood, it’s hard to say whether it’s your water pump or your alternator… * [Andrew Nevins](https://wordpress.org/support/users/anevins/) * (@anevins) * WCLDN 2018 Contributor | Volunteer support * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568732) * Not that we’re asking to look under the hood! * Thread Starter [Chris](https://wordpress.org/support/users/chris_bswish/) * (@chris_bswish) * [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568738) * Good point The Hack Repair Guy * and understood Andrew. * I know W3 total cache just released an update yesterday that claimed some security issues. I cleared out all the files for total cache (all the files to my knowledge) but the issue is still occurring. * The strange thing is that it isnt showing up on any malware scans and not changing my site’s visual appearance Viewing 6 replies - 1 through 6 (of 6 total) The topic ‘Possible Hack’ is closed to new replies. ## Tags * [hacked](https://wordpress.org/support/topic-tag/hacked/) * [hacked plugin](https://wordpress.org/support/topic-tag/hacked-plugin/) * [injected code](https://wordpress.org/support/topic-tag/injected-code/) * [public_html](https://wordpress.org/support/topic-tag/public_html/) * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 6 replies * 4 participants * Last reply from: [Chris](https://wordpress.org/support/users/chris_bswish/) * Last activity: [11 years, 5 months ago](https://wordpress.org/support/topic/possible-hack-help/#post-5568738) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics