Title: Website hack Last modified: July 21, 2026 --- # Website hack * [Andrew Leonard](https://wordpress.org/support/users/andrewleonard/) * (@andrewleonard) * [4 days, 2 hours ago](https://wordpress.org/support/topic/website-hack-7/) * I got this email warning from Wordfence: * **A user with username “**username removed**” who has administrator access signed in to your WordPress site. User IP: 179.60.149.104User hostname: 179.60.149.104User location: Managua, Nicaragua * I then got this email warning from Wordfence: * **A user with username “**username removed**” deactivated Wordfence on your WordPress site. User IP: 179.60.149.104User hostname: 179.60.149.104User location: Managua, Nicaragua * The username was correct (I have removed it) but I live in the UK. I do not know how they found my password – it was a “strong” password suggested by WordPress, 15 randon digits. * They managed to hack my site so the home page showe a fake Cloudfare screen instructing the users to “prove their credentials” by going through a process which would download a malicious file onto their computer. I could not access any page on my website and I could not login to the control panel * The way that I found to restore my website was to rename the Wordfence file in the plugins folder using Filezilla. So the malicious code was “hidden” in the Wordfence folder. * When I regained control I found that there was an update to Wordfence which I installed. My website seems to be working OK now * I have changed passwords and am now using 2FA * Has anybody else suffered from this hack? * Have I done enough to subvert it or am i still vulnerable? * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fwebsite-hack-7%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 1 replies (of 1 total) * Plugin Support [wfpeter](https://wordpress.org/support/users/wfpeter/) * (@wfpeter) * [3 days, 2 hours ago](https://wordpress.org/support/topic/website-hack-7/#post-18972323) * Hi [@andrewleonard](https://wordpress.org/support/users/andrewleonard/), sorry to see that happened to you. * Wordfence is an endpoint firewall that runs after PHP loads, so an external attack vector _could_ have been used initially before the user logged in successfully through the site. Databases, hosting control panels, and FTP can all be accessed without loading your site with Wordfence involved. Try to protect all admin accounts with long, complex passwords and 2FA wherever it’s available. * We always recommend that you make a **full backup of the site before making any changes**. After this, make sure to **remove any suspicious users with administrative access** as a priority. That’s just in case they’ve created a new account to retain access to your site. I see you’ve already made changes to the original account affected by this. * **We also advise you to update your passwords for your hosting control panel, FTP,  WordPress admin users, and database. Make sure to do this.** * Over half of all login attempts that are made on WordPress sites are made via** xmlrpc.php**. Wordfence offers the option to block XML-RPC or at least require 2FA with authentication requests using XML-RPC on the **Login Security > Settings** page. You can also block it entirely using **.htaccess** so long as you don’t use the WordPress app or the JetPack plugin, which require access to it. * I will provide our site cleaning instructions for you below, which may be useful to check even if you don’t suspect anything other than the user to be affected: [https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/](https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/) * Additionally you might find the WordPress Malware Removal section in our [free Learning Center](https://wordfence.com/learn/) helpful. * I hope that helps you out! Peter. Viewing 1 replies (of 1 total) You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fwebsite-hack-7%2F%3Foutput_format%3Dmd&locale=en_US) to reply to this topic. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) * 1 reply * 2 participants * Last reply from: [wfpeter](https://wordpress.org/support/users/wfpeter/) * Last activity: [3 days, 2 hours ago](https://wordpress.org/support/topic/website-hack-7/#post-18972323) * Status: not resolved