Hacking: Unauthorized Admin Login
-
Hi All,
I have a site in which, after activating an activity log plugin, I have discovered unauthorized admin account logins despite changing password multiple times, using long randomly generated passwords. I have already blocked xmlrpc.php using a plugin. When I checked visit logs in C-Panel, matching the suspicious login IP address and time to that recorded in the dasboard’s activity log (plugin), it looks like login was via example.com/wp-json/wp/v2/users (where example.com is our own url) which I think has something to do with REST API. It looks like the hacker was able to somehow login WITHOUT a password.
I understand I can easily disable the /wp-json/wp/v2/users but we NEED REST API because xmlrpc.php has been disabled (which helped reduce brute force attack) and we have plugins (such as Mail SMTP) that require connections to third party sites such as Google (where secret keys are used). How can I secure the site and still be able to use REST API?
-
Hello,
My site was hacked last year and the hacker was able to get administrative access and make him or her as an administrator under users on my WordPress website. Is that possible? I kept deleting it but they came back everyday while I was trying to protect the site. After the 3rd day they hacked me and I had redirects, external links etc. I do have to note that the previous owner of the website had user access as an administrator which I granted him because he was helping me with a few things on the site. What’s the probability that it was him and not someone else? Someone told me it had to be him because the hacker was in the users column with me and him.
- The topic ‘Hacking: Unauthorized Admin Login’ is closed to new replies.