Hacks for last 14 days have been hacking my WordPress Site

That one IP address may be the admins at Bluehost trying to help you… Keep that in mind if they mention having issues getting to the site later on.

Anyway, WordPress itself is pretty robust but the information on the article at…

https://www.ads-software.com/support/article/hardening-wordpress/

Should help you close several doors within your web server itself.

I didn’t see much in the way of security on your website except for the Cloudflare proxy…

I recommend running both of these plugins together… I didn’t see either one on your site but if you don’t have them then I will say, ‘they behave well together and compliment each other’.

https://www.ads-software.com/plugins/better-wp-security/

https://www.ads-software.com/plugins/wordfence/

Hope this helps.

When you say that ALL passwords have been changed, presumably this means:
– Website hosting management login
– Database user and password as configured in wp-config.php
– All WordPress admin user accounts
– All hosting FTP logins

Delete any database users except the one used in wp-config.php

Have you scanned for malware on all your devices ? It could be that a keylogger is leaking your passwords to the bad guys.

Have you read and followed these articles:

FAQ My site was hacked

https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

If all else fails change hosting.

The origins of the hack cannot be known unless you check the server logs and examine the files forensically. Linux commands are typically used for this process. It could be that your passwords have been guessed, the same password(s) is used for another service that has been compromised, a neighboring site on your shared hosting server has been hacked, a vulnerability in a theme/plugin has been exploited, an usupported version of PHP is installed, there is a virus on your local machine, etc., etc.

I would be tempted to enlist the services of a hack repair specialist, who can resolve the issue and explain what led to the hack in the first place, otherwise you may be merely engaging in whack-a-mole. Wordfence and Sucuri are often suggested in the forum. Others are available that are more economical.

If you are determined to resolve this yourself, or do not have the means to hire in help, then follow the links posted above. You might also try: https://www.ads-software.com/plugins/gotmls/

Good luck!

Good morning to you Justin @jnashhawkins

I do use Wordfence – religiously and now will implement the Ithemes’s security
Thank you for your reply

Good morning to you @rossmitchell Ross,

– Website hosting management login ?
– Database user and password as configured in wp-config.php ?
– All WordPress admin user accounts ?
– All hosting FTP logins ?

Additional all Google email login changed ?

Have you scanned for malware on all your devices? It could be that a keylogger is leaking your passwords to the bad guys.
Malware scan on Bluehost ?
I only use Desktop and that has been scanned ?

FAQ My site was hacked – This article was SHITE – but yep read it ?

I like the last idea – of changing hosting as that might be my last resort

thank you for the list of other 3 pages to read through too

Good morning to you @pidengmor

It could be that your passwords have been guessed – all passwords 18Characters random have been changed repeatedly

The same password(s) is used for another service that has been compromised – each service has a different 18 character password

A neighbouring site on your shared hosting server has been hacked – I will follow up with Bluehost

A vulnerability in a theme/plugin has been exploited – in the first day – I removed all plugins and paid themes ( I am using the twenty twenty-one theme – basic)
Plugins like Wordfence was reactivated
Others are being reactivated slowly

An unsupported version of PHP is installed – I have not installed any other PHP – I could ask Bluehost to scan again

I have scanned for malware on Bluehost site about 7 times

There is a virus on your local machine – I only use one machine and it has Antivirus software so no virus.

I will look at the link you shared with me to see how that might assist me

Thank you

Great to see you have strong password management in place. That is definitelty not the issue. A few other measures you can apply:

1) Change the salt keys in wp-config.php to log out all users.
2) Put the site in maintenace mode to stop the site getting blacklisted by search engines and to prevent the visitors from seeing a disturbed front-end.
3) Manually delete and replace all WordPress files with fresh copies, except wp-config.php and the /wp-content/ directory.
4) Manually delete and replace all plugins and themes.
5) Run the Wordfence and GOTMLS scanners and examine any files flagged as suspicious.
6) Manually check the timestamps on your site files in the document root and the /wp-content/ directory for files that were modified around the time of the hack becoming aparent, or for new files with strange names. Look for weird code.

An unsupported version of PHP is installed – I have not installed any other PHP – I could ask Bluehost to scan again

All servers running WordPress will have a version of PHP installed. Your hosting panel should state what version is installed, or your host can advise you. It should be version 7.3.x or above, as anything older is no longer supported with updates (link).