dwinden

@wpforum

Please clarify.

You do not have any File Changes Detected entries in the main Logs page ?

Or File Changes Detected entries exist but the Details link is showing no Added, Removed, Changed values ?

dwinden

@ratputin

Based on this message I see absolutely no reason to get worried.

This is a really good example of jumping too fast to wrong conclusions.

The message does not identify exactly how the website got hacked.
(It only says ” … attack through a security leak in your WordPress software” ).
It could be due to ANY vulnerable plugin or even a vulnerability in WordPress core or anything else …
Based on the 4.4.2 WordPress version specified for this topic, 2 months later, we now know it contained some serious vulnerabilities which were fixed in WordPress 4.4.3 and 4.5.2.

The simple fact that there is a malicious file detected in the uploads/ithemes-security/backups/ folder does not mean that “the iThemes plugin is hacked”. The exact location of a malicious file says absolutely nothing about how the website got hacked.

The iThemes Security plugin is a preventive plugin. But even when properly configured a stupid mistake by the website owner/administrator or a WordPress core vulnerability may get it hacked. Once hacked the only way the iThemes Security plugin will be able to detect that is with the File Change Detection feature.
Using the iThemes Security plugin or any security plugin does not mean your website cannot get hacked. There is also some common sense involved as a website owner/administrator.

Furthermore why was this topic posted in the iThemes Security plugin forum but not in the BulletProof Security plugin forum ?
After a quick look in the BulletProof Security forum I did find this 2 months old topic.

Read it and it will put things in a different perspective.

As we are 2 months further since this topic was posted perhaps the topic owner (obertscloud) could give us an update on the situation ?
Anyway I think this topic should be marked as ‘resolved’.

dwinden

@caral43

Thank you for your feedback.

Just to make sure your solution is clear for the community please confirm:

• you are running WordPress Dashboard 4.5.2 in French language
• you are using the latest French iTSec plugin (5.3.7) translation files with the necessary workaround included/applied to make the iTSec plugin translation work*
• you have set the WPML plugin language in WordPress Dashboard to English

(*The workaround is to NOT translate the “Security” string (or always translate it to “Security”) in the iTSec plugin translation files).

Restored my post after noticing confirmation from caral43.

dwinden

@vizcano

Actually it is related to the iTSec plugin. But it’s related to a different setting (System Tweaks -> System Files) which is not relevant
for this topic.

Try my other ideas.

dwinden

@stratus123

Could it be the author chris-priest has 0 posts and the Disable Extra User Archives (Disables a user’s author page if their post count is 0.) setting in the WordPress Tweaks section of the iTSec plugin Settings page is enabled ?

I noticed the author page does work for other authors …

dwinden

@hicamos

Ok, in that case I think it is best to contact hostgator and ask them to remove the file mentioned in my earlier post for you (if it exists).

As to preventing the lockout you should permanently whitelist your IP address in the Global Settings section on the iTSec plugin Settings page once you get back in. And disable the Away Mode feature…

Are you sure you are trying to login with the correct credentials ?
It sounds like it’s been a while since you actually logged in.
If unsure reset your password by clicking on the Lost your password? link on the WordPress Dashboard login page.

Hope this helps.

dwinden

@john

You might find an answer to your question in this topic.

If the above info was any helpfull please mark this topic a ‘resolved’.

dwinden