milestgmailcom

the site is https://www.aromacda.com

This is a single installation.

No cache plugins or cloudflare

The results do differ. On wp-login.php when I attempt a login it simply refreshes back to the login page. On wp-admin when I attempt to login it refreshes to the home page and I’m not logged in.

I’ve attempted several fixes for this.

Cleared browser cache / computer cache.
Disabled all plugins.
Changed theme via FTP to default.
Ensured database is pointing to uniform URL names.
Replaced wp core files.

So far I have the same results. This is making me crazy.

Thanks for your help in advance!

I can duplicate it.

Otto42, could be. I use HostGator and though I’m generally happy with the service/support I can’t really speak to their security measures. Who would you recommend as a “secure” webhost? Its very hard to tell who’s security is strongest from one host to another.

XtraFancy, yep, it could be in the DB. I’ve read many accounts of people finding ‘bad code’ in their DB files that are tied to this very problem. My DB was very small so I could remake it from scratch. My other blog will be a much bigger challenge. You may want to use Malwarebytes on your PC as well to check for keyloggers etc in case your new passwords are being copied that way.

samboll – I’m using the latest WP (8.4.5?) and its getting hacked. That’s why I assume the vulnerabilities of the code. I upgrade with every new release and these hacks just started happening w/in the last 3 weeks. Thankfully the blog im trying to fix first is a (very) simple, 1 page resume and requires nothing complicated to remake. So killing off all the files and database is no big deal.

Also, I’ve run Malwarebytes, Avast and Kaspersky for keyloggers or anything else on my machine and they come up clean. I’ve changed my password many times to the most cryptic stuff I can come up with, on both my admin and FTP.

So, yeah, irritating.

I’m having the same problem. My webhost installed a php.ini in my WordPress root folder (which they said would prevent my .php files from being written to) and I tried placing my configphp file into my server root folder but it was still hacked. THis is after a full, fresh install with no plugins installed and a new database. Soooo yeah. Kind of irritating and making me question why im using WordPress at this point if the code is soooo vulnerable.