robfaich

Thanks a lot but it turns out another admin did it, sorry to have waisted people’s time.

Thanks a lot, I’ll try that.

Thanks, but how would you set a meta tag in WP?

Plugins:
Advanced Editor Tools
AMP
Fast Secure Contact Form
GoodBye Captcha FastSecureForm
Official StatCounter Plugin
PHP Compatibility Checker
Really Simple SSL
Shield
WP Mail SMTP
WPBruiser

That did help, it’s now done, thanks a lot Sage!

Just discovered I can use rewrite rules after all, looking into it.

Meanwhile: anybody care to comment on desirability of redirecting xmlrpc.php requests back to 127.0.0.1 versus IP blocking?

Thanks sterndata but I’m finding it hard to believe that the sort of increase in attacks I’m seeing are not due to something about this setup.

I said before that the running monthly bandwidth usage total increases nearly every day, but over the past 24 hours it rose by over 7%, and it’s well over 40% up on 10 days ago. Over that period bandwidth on my three busiest sites is 87%, 95% and 98% due to xmlrpc.php.

I don’t have server level access and don’t believe I can use URL rewrite (there’s nothing in online support about it). Any other suggestions?

Hi slickrockweb, thanks a lot for taking this trouble. I used FileZilla to do a search on those filenames, which were not found. I’m doing a Sucuri SiteCheck every few hours. I’ve decided if that finds anything I’ll wipe the site clean and start from scratch (following https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/), otherwise I’m keeping my fingers crossed.

Rob

Thanks again, it tests clean now so I feel I can postpone further actions to tomorrow but I’ll do a proper job then.

Thanks very much WPyogi. Files index.php and wp-blog-header.php (at least) had been modified so I changed the admin password and reinstalled WP. I’m now looking at what else I should do.

Thanks WPyogi, it’s now fixed. I tried to change the logo a few times with no effect on the file path. Then I went into the other Theme Options page, that I’d previously gotten into my head was not to be meddled with, and successfully changed it from there. I think it’s because I have OptionTree that I have two options pages, but I have to say, it’s really confusing.

Thanks guys. Sorry I didn’t spot that myself. I’d experimented with a child theme but it’s not active, it seems something went wrong when it was deactivated, leaving references to it. I’ve now deleted the child theme folder but that’s obviously not going to fix that reference. In fact I now see it’s wrong anyway, the folder name was skeleton-child. Very strange. Any ideas on how I can fix this?

Re the theme demo’s lack of a logo, I don’t remember the setup details now, but it’s certainly a theme option on my site.

Yes it would but you are still on the sapphire_stretch_2 theme.

Not sure why you say that, of course the footer credits that theme but with the themes folder renamed none of its files could be accessed.

I’ve now put themes and plugins folders back as they should be and replaced all the hacked files in the root folder (also deleted some cuckoo files in root and subfolders) and, though I’ve yet to do a thorough test, I’ve been able to log in and it looks like all is well. Thanks again.

esmi: no

keesiemeijer: I’d have thought that renaming the themes and plugins folders would have covered your first two suggestions.

I just went in to check whether I have .htaccess (I don’t), and noticed that some of the file datestamps are odd-looking, including index.php, and on opening that I see links to a jewellery website, so I’ve been hacked! It looks like I’ll have to follow your last suggestion.

Thanks to both contributors. Before I close this topic, are there any suggestions regarding getting the site fully functional again, and/or what I can do to avoid this happening again?

I contacted the theme author, Scott Allan Wallick, who was good enough to reply with the instructions below. Scott has written 6 great minimalist themes, including Sandbox, which I believe is to be integrated into the wp core. He suggested I put a link to his contact page here so anyone else needing support can easily request it.

The sidebar is hidden on pages and single posts using CSS. The function is there so that if folks want to customize the theme they can do most everything with CSS alone.

These directions should get you in the right direction, beyond that check the readme.html for CSS resources.

In the style.css file, go to line 26. It’s a long line full of ‘selectors’. Within that line, find

body.single div.sidebar,body.page div.sidebar

(Two selectors, separated with commas.)

Delete only those two (just the text that appears above).

Now go to line 33. Find

body.single div#content, body.page div#content{margin:3em 0 0;}

And delete the entire line. The whole lot.

Save the file, upload it to your server. Clear your browser cache. Refresh. And you should see the sidebar everywhere.

I’m a novice myself, but I’d say your main column is too wide, pushing the sidebar down below it.