My password-protected pages are suddenly no longer accessible

I think you’ll want to check your theme. It looks like it’s been hacked –
https://sitecheck.sucuri.net/results/www.cityofsailschorus.com/

Here’s more info to get you started:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

https://sitecheck.sucuri.net/scanner/

Thanks Christine. It looks like this one: https://blog.sucuri.net/2012/12/website-malware-sharp-increase-in-spam-attacks-wordpress-joomla.html.

What I’m curious to know is how these cretins get into the site. The hosting provider isn’t interested – “it’s your problem, not ours”, though when this happened with another site I administer, I found that all the sites that were co-hosted with mine were also infected – I just checked the adjacent IP addresses, but that approach doesn’t seem to work here.

At first glance it looks as if only one file – header.php – is affected, though even after fixing that the site still seems to be broken.

I’m currently getting a snapshot of the wp folders and will take a better look.

Hi again Christine,

The site now reports as clean after the Sucuri scan, but the password problem is still with us. I also seem to have a rogue fragment of HTML showing in the header (if you look at https://www.cityofsailschorus.com/members-area/password-test-page you can see it just to the right of the “pole”) so something is still screwy somewhere. I don’t know where next to look.

Thanks for your help,
Ross

This event turned out to be two problems. The first was the hijacking of my footer.php file by a link farm as described here. This didn’t actually have any visible impact on the operation of the website that I can see. The password problem was due to the handling of passwords being changed between the version of WP I was running to version 3.5 (see here).

I still have a problem where the markup for a slideshow is now not being parsed correctly and is resulting in the fragment of markup being emitted to the page, also I suspect related to the “upgrade”.