Title: WordPress Hack that comes back
Last modified: June 7, 2021

---

# WordPress Hack that comes back

 *  Resolved [wasootch](https://wordpress.org/support/users/wasootch/)
 * (@wasootch)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/wordpress-hack-that-comes-back/)
 * Hello,
    I had a hack on a few of my sites, but not all of them, hosted on the
   same hosting company. The file installed was wp-content/plugins/plugs/plugs.php.
 * I installed Wordfence and did the scan and it found the hack and deleted the 
   file from the 3 sites effected. I checked my other sites and they were fine.
 * It was fine for a while, but now it came back despite having Wordfence installed
   and it actually seems to have stopped the Wordfence scans to find it.
 * I have deleted the files again with Wordfence, but I’m not sure how it is getting
   installed. I checked the common plugins and the only common ones are on all my
   sites rather than just on the 3 hacked ones.
 * Does anyone know how this is getting in?

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Plugin Support [wfphil](https://wordpress.org/support/users/wfphil/)
 * (@wfphil)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/wordpress-hack-that-comes-back/#post-14529172)
 * Hi [@wasootch](https://wordpress.org/support/users/wasootch/)
 * If a reinfection keeps occurring then the same hacker, or even a different hacker,
   is very likely exploiting the same vulnerability because the intrusion vector
   hasn’t been patched yet.
 * Please follow our site cleaning guide below:
 * [https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/](https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/)
 *  Thread Starter [wasootch](https://wordpress.org/support/users/wasootch/)
 * (@wasootch)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/wordpress-hack-that-comes-back/#post-14530102)
 * Hummhhhh…. ok. I did do most of that to begin with. But I tried a couple of more
   things to see if it will help. Got rid of themes I’m not using. One site did 
   have an old version of WordPress, but the others didn’t. So I’m not too sure.
 *  Plugin Support [wfphil](https://wordpress.org/support/users/wfphil/)
 * (@wfphil)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/wordpress-hack-that-comes-back/#post-14532185)
 * Hi [@wasootch](https://wordpress.org/support/users/wasootch/)
 * Thank you for the update.
 * The only advice we can give here in the forum is already fully included in our
   site cleaning guide.
 * I recommend that you monitor your website closely over the next few weeks for
   any signs of a reinfection.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘WordPress Hack that comes back’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

## Tags

 * [wordpress hack](https://wordpress.org/support/topic-tag/wordpress-hack/)

 * 3 replies
 * 2 participants
 * Last reply from: [wfphil](https://wordpress.org/support/users/wfphil/)
 * Last activity: [4 years, 11 months ago](https://wordpress.org/support/topic/wordpress-hack-that-comes-back/#post-14532185)
 * Status: resolved