roseba

I have been to every single one of these links and executed almost all of them except for exporting the database and making a new one. (Because I don’t have really old backups, before the site was infected.)

And some of the htaccess rules didn’t work for me, and instead made it impossible for me to get back into my own site.

I’m not sure if it’s that. The “malware” is something I have had on my computer for three years and it doesn’t appear to be modified. I don’t think it is that. I think it may be a false positive.

I’m still looking. Especially since I have replaced all my files from more than one location.

If it’s an infection in the database, I’m in trouble because I don’t know my way around that too well.

Limit lockouts had to be removed because every time I reactivate it, it locks me out. Gives me a connection error.

(Too bad, it worked pretty well).

It seems my problem continues to morph. I’m not a security expert by any means, but I am not a noob either. This problem is the worst hack I’ve ever had to try to recover from.

I had to remove all my permalinks and make everything the default so it doesn’t redirect all of my links.

My computer is infected with malware. I’m continuing to run the scan to catch all of it.

I suppose I shouldn’t do a clean install of anything until I fix that.

Great, I just tried to change it, and it locked me out of my admin. And because I have a safeguard for too many login attempts, I can’t get in for the next 20 minutes.

Not my wordpress admin. But my ftp and database accounts have been changed.

I get the impression it isn’t from my login. And more of a backdoor thing.

I’ve changed my admin password a lot in the past few weeks.

@govpatel are you speaking to the original poster or me.

For me, I’ve replaced the files clean several times and the problem keeps coming back. I’m on the latest version of WP.

Did you ever get this fixed, because I continue to follow all of these suggestions, and none of them work.

Did you ever figure out what this was? Because I’ve done almost all the steps that people have suggested to “harden” WordPress and have done numerous reinstalls (clean) and still could not unhack my site.

It continues to come back.

Who ever was at it, is still trying to do this. This is frustrating because I don’t know what the original exploit was, so I can’t shore it up.

And despite the fact that I have listed the ip addresses to ubiquity, they don’t want to do anything about it.

The latest is this morning from: 108.62.220.8

Theme is clean. Hopefully, I killed whatever code was there by reinstalling everything cleanly.

I will look at your suggested plugin. All my plugins are newly installed from WordPress. (I didn’t keep what was there)

I don’t know what dsnextgen is. But I did try switching the permalinks to default. It worked. Then I switched it back to custom and it also worked.

Thanks for your help. I have to do some back end work to see if there are other things out there to clean up.

I do feel there was a hack because of the unusual traffic I was seeing, especially the bunch of referrals coming from youtube, for instance. (I don’t have anything on youtube). And a bunch of other small websites. And the number of requests in the past week to read my xmlrpc.php file and my robots.txt file.

I did switch the permalink structure, found it to work, switched it back and now it works. Fascinating.

I’m not sure what you are saying. Last night, I deactivated ALL of my plugins.

I followed that by deleting the entire directory, and then reinstalling wordpress from scratch. Then I reinstalled all the plugins from scratch.

So all files there, are brand new files except the robots.txt and htaccess and the wp-config file. (And the theme I had a backup of)

Oh and my website is https://www.roseba.com/