EMar

Hi,

Oh, I never though of XMLRPC, I just changed those default links.

I’m using Waveme theme, they have their own registration built-in,
The only place I have the login link is a top menu item, it’s a popup (btn-ajax-login)
It also/still takes the user to custom login and register pages, as part of the theme.
I also enabled that reCaptcha (v2) feature in the User Verification plugin.

Thanks,

There’s nothing really in the file that’s insecure,
But I don’t think the file should be public.
It’s belong to Wordfence I think.

Thanks for the info,

I looked at the crawler info for those fake links in Google Search Console last night,
They were dated Dec 2025, then today, some of them were updated to 16th Jan 2026.
A lot of the links have disappeared after Validating them yesterday..
Some of them are still redirecting to the fake site, but they’re being verified/passed by Google Search Console.

I can’t locate the backup, I was in a hurry to move the website and domain to the new server.
Was using Wordfence scan regularly on the old server and didn’t notice anything major.
Don’t recall any notices of files or directories being altered, I found two index.php files in wp root.

The hacker either used ftp, or got access to my control panel/ssh to be able to add those files.
Either way, I think I’ve done an decent job of cleaning up the WordPress directories, more work needed

The new server control panel doesn’t have any accounts created for FTP.

I created new database credentials when migrating with Duplicator.
New admin login info for WordPress on the new server.
Regular updates of server control panel credentials.

I have firewall on the server and in WordPress.

Need to do more investigating.. how are they creating those fake redirect links.

Damn I didn’t think of that, appreciate you taking a look.
I have CloudPanel and Azuracast configured on one IP, they use Nginx.

I have disabled Guest mode and testing the site pages.

Thanks!

@yaniiliev thanks! I got it sorted in the end.
Yes, I’m delighted I didn’t even need to touch the database or anything else.

@vaakash

Thanks for checking, I disabled the plugin last night, it’s enabled again.

I do have that option selected for On mobile (or) small screen = Hide
Responsive width = 768.

Thanks,
EMar

I was unable to upload the zip file for 3.22.2 as a plugin.
That’s why I unzipped it and uploaded the files, overwriting the others.

I didn’t do a backup at that time.