ThorHammer

Noone with any suggestion? I have not done anything with the source code.

Something is wrong with your theme, photogram. Are you sure your theme is updated?

You should explain your problem a bit more detailed.

Check if your site is hacked again, it might be …

Also: Search your database (option table) for ftp_credentials. Perhaps someone has full access to your server via your database … If you are using filezilla this is even more possible.

Have a look at your control panel->settings->reading

If your front page is a wp-generated page you will see the name of it here. If not, maybe your Index.php is calling a page template which is your front page. This is all about the theme you are using. Have a look into the files in your themes folder. I supsect that your homepage shows static content, and then you have to edit this file in order to change what it shows.

I am almost sure that those “users” are created by robots just in order to use you as a base to publish spam. I had a similar experience with an old site of mine, I actually emptied the database in order to let the site die, there was nothing visible at all, but still, I got emails tellign me that some ghosts indeed were registering at the site …

Your child theme folder will NOT be updated if you followed the steps. That is the genious thing with using a child theme.

I forgot to mention: these “useres” will most likely use your site to post their spam.

This sounds really odd. Have you found any explanation so far?

Use a FTP client and delete all files, or, if you want, download everything first. Then reinstall WP from a fresh download. Do the same with your plugins and themes. Do not upload any of the eventually dowloaded theme files before your have crawled through each line of them. In all my recent hacking attacks the malicious code was placed in the themes header and in the root htaccess file.

You really should consider to manualle evaluate each user before accepting them. You don’t need any non-human user, do you?
It might be a possibility that these “users” are doing this in order to follow your website and watch if/when you have an outdated WP, plugin or theme with security flaws. And then tehy will attack you.
It is always smart to be paranoid.

Read esmis post. AND: Scan your PC for malware, viruses and trojans. Are you by any chance using Filezilla as FTP-client? If so, and if you have a trojan resting inside ypur PC, the attackers still have full access to your entire website, since Filezilla stores all your user credentials un-encrypted as a txt-file on your PC.

Remove ALL WP-files, themes and plugins. Reinstall from fresh core files. Change mysql user / password, add new salt code, change your login password to something very strong. You should also consider changing your ftp password and check your computer for virus, trojans and malware.
Then, hopefully, if not the hacker has added something nasty in your DB, you have a fresh start.

Which theme do you use?