WFBrian

Hi Mike,

Will you please send the file to samples@wordfence.com and include that it was not detected in the scan? That will get in the queue to get evaluated.

-Brian

Hi,

If you can provide some more info, I’ll do some digging and see what I can find.

What files were infected? Was it a theme? Are you on a shared host?

Thanks!
Brian

Hi Stan,

Just so I’m clear, everything was working normally until the time change? Will you provide a screenshot of what you are seeing? What kind of host are you on (shared vs dedicated) and what type of server?

Thanks,
Brian

Hi there,

That is not normal. Maybe something wrong in the database. I’d suggest removing the Wordfence tables in the DB and trying to reinstall Wordfence again. Since you can access your site after deleting the WF folder, try the following…

-Install the Wordfence Assistant plugin. You can find it by going to Plugins and Add New. Then do a search for “wordfence assistant” without quotes. You can also find it on this page in the official Wordfence plugin repository.

-Use Wordfence Assistant to Delete all Wordfence data in your database.

Try to install Wordfence again. Let us know if that helps or the issue continues.

Thanks!
Brian

Hi,

Will you please post a screenshot of what you are seeing? That will help us troubleshoot.

Thanks!
Brian

Hi,

Glad you like it! Do you have an email address populated here under Options?

http://docs.wordfence.com/en/Wordfence_options?utm_source=plugin&utm_medium=pluginUI&utm_campaign=docsIcon#Where_to_email_alerts

I have it blank on one of my sites and I do not receive the email alerts. That’s the first place to check.

-Brian

Hi,

Sorry for not being clearer. My point was that there are plugins out there that only restrict access to the password reset form. Since we do not offer that currently, using one in addition to WordFence might get you the functionality you are after now. I can definitely add your suggestion to our list. We evaluate all user suggestions but cannot guarantee a feature will be added.

It is very concerning that there are constant attacks on websites. Before I used WordFence, I had no idea how much my sites were being attacked. We’ll never be able to stop the attacks, but we can take precautions to limit the risks. Not having a user named “admin”, using strong passwords, keeping themes and plugins up-to-date, using protection like WordFence are all examples of tactics to limit the risk. I’d be much more concerned if attackers were trying to access your site with actual user names in your database. The tactic you are seeing is basically guess a username and if it exists, attempt to break the password. To my point, since the user they are attempting to use does not exist in your database, they cannot use it to access your site.

-Brian

Hi,

We have a support document on cleaning a hacked site. It’s a great resource to get you started.

https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

As to how it could happen, it could be several things. Usually, it stems from running an older version of WordPress, a 3rd party theme, or plugin that has a vulnerability. A user account can be compromised too. At this point, change all users passwords and make sure WordPress, themes, and plugins are all up to date.

-Brian