Title: salescart's Replies | WordPress.org --- # salescart [ ](https://wordpress.org/support/users/codeaholic/) * [Profile](https://wordpress.org/support/users/codeaholic/) * [Topics Started](https://wordpress.org/support/users/codeaholic/topics/) * [Replies Created](https://wordpress.org/support/users/codeaholic/replies/) * [Reviews Written](https://wordpress.org/support/users/codeaholic/reviews/) * [Topics Replied To](https://wordpress.org/support/users/codeaholic/replied-to/) * [Engagements](https://wordpress.org/support/users/codeaholic/engagements/) * [Favorites](https://wordpress.org/support/users/codeaholic/favorites/) Search replies: ## Forum Replies Created Viewing 15 replies - 1 through 15 (of 87 total) 1 [2](https://wordpress.org/support/users/codeaholic/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/codeaholic/replies/page/3/?output_format=md) [4](https://wordpress.org/support/users/codeaholic/replies/page/4/?output_format=md) [5](https://wordpress.org/support/users/codeaholic/replies/page/5/?output_format=md) [6](https://wordpress.org/support/users/codeaholic/replies/page/6/?output_format=md) [→](https://wordpress.org/support/users/codeaholic/replies/page/2/?output_format=md) * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [12 months ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18471714) * I already have comments deactivated in settings. The hackers were still adding comments. That’s why the people who originated the plugin originally created it because that feature as well is routinely hacked on WordPress. Like I said I have been doing this for awhile and WordPress is the most hacked piece of software ever created. In fact, at my other job, the security team doesn’t allow WordPress anyone in the agency. With the plugin the comment hacking stopped. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18460504) * [@asadullah96](https://wordpress.org/support/users/asadullah96/) How are they doing that? * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18460503) * I have taken a copy of the parent theme,. SKT IT Consultant and created a child theme. Only the smallest of changes to the style sheet to make it look differently. I use code snippets to: * [**Completely Disable Comments**](http://www.comcity.com/wp-admin/admin.php?page=wpcode-snippet-manager&snippet_id=12574) Everywhere. Because that seems to be another hack in WordPress. Even when you have no “forum” in your website, people can somehow still make comments. Modify the header to add LivePerson support. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18460486) * I have been hosting websites longer than wordpress has existed or that the wordpress domain has been registered. I started with FrontPage websites which were never hacked. * I’ve got like 4 WordPress websites on my servers. They are all hacked at will and have been since inception from Day 1 relentlessly through a generation of mySQL, PHP and Microsoft servers, and from virtually no plugins to 5 or 6 plugins. From tight permissions where you can’t even install a plugin or an update to recommended permissions. [https://brudtkuhl.com/blog/wordpress-iis-permissions-updates-permalinks/](https://brudtkuhl.com/blog/wordpress-iis-permissions-updates-permalinks/)**** Mind you nothing else and no other websites have ever been hacked except when someone’s username was compromised or something obvious. It doesn’t matter what I do. These are the current plugins: * ```wp-block-code Ninja FormsNinja Forms is a webform builder with unparalleled ease of use and features.Version 3.10.1 | By Saturday Drive | View detailsSimple Custom CSSAdd CSS | DeactivateThe simple, solid way to add custom CSS to your WordPress website. Simple Custom CSS allows you to add your own styles or override the default CSS of a plugin or theme.Version 4.0.7 | By John Regan | View detailsSimple Disable XML-RPCDeactivate | SettingsSimple Disable XML-RPC is a user-friendly WordPress plugin that empowers website administrators to easily control and secure their site by enabling or disabling the XML-RPC functionality. With a simple toggle switch, this plugin helps protect your WordPress site from potential XML-RPC-related security threats, enhancing your website's overall safety and performance.Version 1.3.5 | By WordPress Satkhira Community | View details Wordfence SecurityUpgrade To Premium(opens in new tab) | DeactivateWordfence Security - Anti-virus, Firewall and Malware ScanVersion 8.0.5 | By Wordfence | View detailsWP Sitemap PageAdd a sitemap on any page/post using the simple shortcode [wp_sitemap_page]Version 1.9.5 | By Tony Archambeau | View details | Settings | DonateSelect WPCode Lite Easily add code snippets in WordPress. Insert scripts to the header and footer, add PHP code snippets with conditional logic, insert ads pixel, custom content, and more.Version 2.2.7 | By WPCode | View details ``` * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18459833) * I have been restoring from a clean backup EVERY time. The same backup from 2018. I have all the original content including the database backups from 2018. The site starts out clean but it is only a matter of time before it is hacked again. WordPress is very easy to hack. Not only did I start with a backup from 2018, but I deleted all of the wordpress and started with the latest version of wordpress. Then I added WordFence and have run multiple scans including comprehensive scans where it compares files and replaces them. The Wordfence scan is clean. It fact, it is what notified me that someone simply added an admin account. This is all new install of mySQL as well with all updated root username and password. They still walk right into this software like it is hackware. - This reply was modified 1 year ago by [salescart](https://wordpress.org/support/users/codeaholic/). * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Admin users created at will with WordPress](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/admin-users-created-at-will-with-wordpress/#post-18459804) * I’m running the wordfence plug-in which verifies everything is cleaned up and repairs all files. I also deleted all of the WordPress extra folders and had them all reinstalled. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [IIS Permissions that will result in no hacks](https://wordpress.org/support/topic/iis-permissions-that-will-result-in-no-hacks/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year ago](https://wordpress.org/support/topic/iis-permissions-that-will-result-in-no-hacks/#post-18438564) * Thanks James. This isn’t answering my question. My question is what are the correct IIS permissions for WordPress? * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Hacked over and over again](https://wordpress.org/support/topic/hacked-over-and-over-again/) * Thread Starter [salescart](https://wordpress.org/support/users/codeaholic/) * (@codeaholic) * [1 year, 6 months ago](https://wordpress.org/support/topic/hacked-over-and-over-again/#post-18124731) * This is what I am seeing. * Someone has found a way to upload files which is the most bizarre thing….how can they do that? The files have numbers and the contents have PHP content: