Can someone log in without being a user?

Hi Bob @bobhatcher,

Does ‘User Login History’ tell you what user has logged in from that IP? E.g. ‘Alice’ has logged in from ‘12.345.67.8’?

I would also change all users’ passwords for the site, in case your members passwords have been compromised.

To further secure your site, I have found WP Cerber to be very effective and easy to use. WordFence is another popular plugin. Both have really good free versions available, and are available on the WP plugin repository.

Most hosting providers also have the facility to block specific IPs, IP ranges, and some even whole countries. I think the WP Cerber plugin has this feature. It may be worth a chat with your hosting provider.

Hopefully they are not admins on the site, and your site is still safe!

Good luck, and I hope this helps.

Kind Regards,
Tim

Hi Tim,
Thanks for your quick response. Yes, it gives details that I included above: giae254029987 Chrome (53.0.2785.104) Windows 37.230.138.123

and I tracked the IP address to Russia which made me worry. I did some research and found Wordfence so I installed that so hopefully it will work to keep this guy out.

Question, if he hacked into someone’s account, wouldn’t it have shown under their username and not “giae…”?

I’m still curious how someone without an account can log in. That’s strange.

Bob

Hi Bob,

So is giae254029987 not the username? I have no idea what that is if that’s the case, I don’t have experience with that specific plugin.

Unless you have self-registration enabled on your site, then it’s impossible that they could’ve logged in without an account. Check your Users list. Perhaps the log entry was an attempt to login (maybe as giae254029987)?

It’s not possible to login without an account – otherwise it wouldn’t be logging in, you’re just a visitor! ??

Kind Regards,
Tim

Yes, the giae… is the username. I do not have self-registration enabled which is why I’m confounded and asking for help from the experts here. Here is a link to the screenshot https://plymoutharearepublicans.org/wp-content/uploads/2021/04/image_2021-04-21_164512.png

There are about 25 different logins.

Bob

Hi @bobhatcher,

The user giae254029987 is likely compromised. Change the password ASAP, then you can add additional security and monitoring through a plugin like WordFence.

Kind Regards,
Tim