Title: JohnW63's Replies | WordPress.org --- # JohnW63 [ ](https://wordpress.org/support/users/johnw63/) * [Profile](https://wordpress.org/support/users/johnw63/) * [Topics Started](https://wordpress.org/support/users/johnw63/topics/) * [Replies Created](https://wordpress.org/support/users/johnw63/replies/) * [Reviews Written](https://wordpress.org/support/users/johnw63/reviews/) * [Topics Replied To](https://wordpress.org/support/users/johnw63/replied-to/) * [Engagements](https://wordpress.org/support/users/johnw63/engagements/) * [Favorites](https://wordpress.org/support/users/johnw63/favorites/) Search replies: ## Forum Replies Created Viewing 15 replies - 1 through 15 (of 15 total) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Wordfence Security - Firewall, Malware Scan, and Login Security] Admin users changed. No alert from WordFence](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/#post-15435054) * I’ve changed to using secure FTP. I’ve removed unneeded database and back-end user accounts. I’ve changed all the passwords of my personal e-mail as well as the site emails. I stopped using a gmail account that was suspicious and made a new one. I’ve deleted the WP folder and database and started new. I installed WordFence right off and left the WP install alone, just to see what happens. After a few days the admin account is edited. There must be a log I can see that shows WP database activity that I can use to track down how this change occurs. * What change logs are available in the WP database or the phpmysql screens provided by hosts? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Wordfence Security - Firewall, Malware Scan, and Login Security] Admin users changed. No alert from WordFence](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/#post-15424693) * Well, Peter. * I decided to go all out and deleted the WP folder and the WP database and started over. PHP is up to 8.0 and got WP reinstalled. I installed WordFence again to have 2FA * 2 days later… my admin login is changed again to a version of “AnonymousFox”. I’ve changed the admin login name and used a randomized password when I reinstalled. No alert from WordFence to my email. * I’m starting to wonder if keeping my WP front page is worth it. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Wordfence Security - Firewall, Malware Scan, and Login Security] Admin users changed. No alert from WordFence](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/admin-users-changed-no-alert-from-wordfence/#post-15413132) * Since the hacker used one of my email accounts as the email for their admin account, I suspect it might have been that. I’ve changed every password I’ve found and deleted accounts that I don’t need any longer. * Since I only use WordPress for my front page, I think I’m just going to blow it up and start from scratch. I was really liking the reports from Wordfence and the 2FA part. Just really surprised I got hit again. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Had to create new Admin, now can’t get to Dashboard](https://wordpress.org/support/topic/had-to-create-new-admin-now-cant-get-to-dashboard/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/had-to-create-new-admin-now-cant-get-to-dashboard/#post-15409632) * I can’t get to the dashboard. How do I disable any plugins? * I can’t get to a Troubleshooting tab to change modes * All I get is my web page up, with a Howdy greeting on the fat right, where I could logout and a WordPress icon on the far top left with WordPress.org, Documentation, Support and Feedback in the menu. An Icon next to it looks like a speedometer, but clicking on it takes me right back to the page I already have. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15383287) * I’ll make a quick backup. * What does the meta database do? It almost looks like it keeps track of changes or settings that the user makes. The other users have so many more lines in the database than my new admin does. * As long as I have full admin rights to maintain my new WP install, I’ll be fine. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15377682) * I would still like to know if I can remove the meta database entries associated with the user accounts I removed. User ID 1 and 2. My new user has a much higher user ID on purpose. They just have more meta lines than the one I created manually. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15373819) * I got the new admin to get to the dashboard. My prefix for the database was not just wp_. Once I edit that to match the database names correctly, it worked. * I guess I still need to know how someone got in when nothing was the same. My admin account was new and the password a random generated 16 char string of stuff. I also had 2 factor auth enabled. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 5 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15373808) * OK, more support needed. * I got an email alert from WordFence that a user I didn’t recognize had not been allowed to login to my WP. I surfed to my WP login and used the user I created after removing the previous WP install in total, and installed a clean copy. My admin account no longer could login. Great. I used my hosts provided PHPMy Admin to check the users in my WP database. Two users I didn’t create and my admin account wasn’t there either. I deleted both of those and created a new administrator user based on the steps I found in a web article. The user works to login, but I can’t get the to the WP dashboard. I looked at the meta-data section of the database and I see the last few entries of for my new user and most are for user ID 1 and ID 2, which I probably deleted. * 1) Can I delete those records in the meta database? 2) How do I get access to the dashboard again ? Some more info in the database I need to add? * 3) How the heck did I get hacked again with a fresh install and new account created? WordFence didn’t tell me anything but my own logins when I was building the page, but clearly, something is left open. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15331062) * From needing to use 2 Factor at work, I’ve gotten used to having the cell phone with me most of the time. * To be honest, this may all be a good thing. Other than the first 24 hour freak out part. I hadn’t changed my main web page in years. I had gotten lax in lots of things. I just use Word Press for this page, and a few other static info pages. The rest is forum software. * I just need to find a theme that fits the layout I want to have and start editing. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15329541) * I’ll bookmark that for future reference. I was in the MySql database, but I didn’t see the existing password set as MD5 type. It was blank. * I’m working through the hardening steps on the new install, now. Two-factor authentication is in place and the fence firewall plugin is installed. Still plenty of things to check. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15326699) * Since my WordPress section of my web site is small, I think it would be best to blow it up and rebuild from scratch. Can I just delete the WP folders and then install WP back on the server and build from there? * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15326587) * I tried changing the WP admin password by editing the wp_users database, but the change doesn’t seem to take affect. The login from the web page still fails. I would think manually changing it and saving would be all it takes. * Any ideas? * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15324572) * Thanks for the link Steve. * I’ve given it a quick look-through to get a feel of the scope of steps. I normally make a good backup at the end of the year but didn’t this time. Of course. I have older backups and I may just revert to one of those, then go through all the upgrades to get current. * I think knowing what folder to kill before restoring will take some time, but the ones dated Dec 26 will be on the list. * John * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [Suspicious folder in my WP directory](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [4 years, 6 months ago](https://wordpress.org/support/topic/suspicious-folder-in-my-wp-directory/#post-15322349) * There other folder with the Dec 26 date is the “upgrade” folder, and it is empty. * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [WordPress as a front page ?](https://wordpress.org/support/topic/wordpress-as-a-front-page/) * Thread Starter [JohnW63](https://wordpress.org/support/users/johnw63/) * (@johnw63) * [12 years, 1 month ago](https://wordpress.org/support/topic/wordpress-as-a-front-page/#post-5077420) * I don’t yet have WordPress installed. I only have the web site CURRENTLY redirected because Nuke can not work with the newest version of PHP. I want to turn OFF that redirect to the phpBB forum, as soon as I can. I used to do more articles on the front page and had links to “popular topics” in the forum, but I couldn’t keep up on it, so it has become more a front page that mostly gets people interested in what we do and a link to the forum where all the real info is. Php-Nuke is out of the picture, now, so I need to decide on a new CMS or method of creating a new “portal” to the forum and if it is easy to post new info and make the page look modern, so much the better. WordPress is one of my top choices. Viewing 15 replies - 1 through 15 (of 15 total)