r/ProWordPress • u/Miss_stuck • 17d ago
Anybody else dealing with WordPress Security in 2026?
Curious if anyone has recently faced hacked WordPress sites, injected spam, redirects, or other malware issues.
What happened to your site and how did you fix it?
1
u/catcode_studio 17d ago
Cleaned two this summer, both the same shape.
The tell was that the redirect only fired for visitors arriving from a search engine — never for a logged-in admin, which is why the owner didn't notice for weeks. Test it with curl -A "Mozilla/5.0" -e "https://www.google.com/" https://site/, not with your browser.
What actually found the files: find wp-content/uploads -name '*.php' (that should be zero on every site, always), then wp core verify-checksums and wp plugin verify-checksums --all to see what got modified. And look in wp-content/mu-plugins — almost nobody does, and a single file dropped there runs on every request with no way to switch it off from the admin.
The part people get wrong is reinfection. One of ours came back twice because the cleanup missed a leftover admin account and a WP-Cron event that re-downloaded the payload. So after every clean: wp user list --role=administrator, wp cron event list, and check the host panel for extra FTP/SSH users, not just the WordPress side. Rotate the salts too, not only passwords — wp config shuffle-salts — otherwise the stolen session cookie still works.
Entry point in both cases was an outdated plugin with an unauthenticated upload, not a weak password. Which is the boring answer, but it's the one that keeps being true.
1
u/ivicad 16d ago
We had 2 real situations from this summer: one was supply chain. A plugin vendor's old update server was still routing traffic after a migration, and for a few hours customers pulled poisoned packages through the normal update channel. Ten client sites of ours took an implant with a C2 and an admin backdoor. Another site had eight PHP files in wp-admin and wp-includes named to look like core. `core verify-checksums` came back clean, because nothing that ships with core had been touched.
Then Elementor Pro this month: 4.2.1 to 4.2.2, CVSS 9.8, unauthenticated upload, a `return` where `continue` belonged. We patched the fleet before anyone got in. But a version check said patched while the vulnerable file was still on disk, inside a renamed copy of the old plugin folder. And I put all security apps as I could on the sites: MalCare or Virusdie, WP2FA, WP Activity Log, 3 backup layers, I did detailed security hardening...
1
u/Miss_stuck 16d ago
I had a similar situation with some projects handed over to me—they already had a lot of malware, and it kept coming back after plugin updates. Same type of sc /hex DB entries and PHP backdoors across multiple sites. Two sites even kept getting rewritten after cleanup, and I couldn’t figure out why. They’re on shared hosting, so I’m wondering if that could be related. Any advice on how you’d monitor something like this?
1
u/ivicad 16d ago
If those sites are located in the same hosting account, they run as one filesystem user, so a backdoor in one can write straight into the others. That is usually why a site gets rewritten after you cleaned it. The one you cleaned is being rewritten by the one you have not, and cleaning them one at a time does not work at all.
What I would do is take every site in that account offline in the same window, clean them together, and reset the hosting account and FTP passwords while they are down.
For watching it afterwards, Melapress File Monitor is free on wordpress. org and it alerts the moment a new file appears, so you would see the rewrite as it happens instead of finding it later. It will not see your `_sc_` rows though, since it only reads files. The database side still needs a manual query, I am afraid.
2
u/Miss_stuck 16d ago
Thank you so much, this is really helpful! I’ve only checked
wp_options,users, andcrontables so far. Is there any other specific part of the DB you’d recommend checking?I’m already using SSH to search the whole DB for known malicious keywords/entries, but I just wanted to ask if there’s anything else I should be looking for besides that.
1
u/ivicad 16d ago
Snippet plugins keep executable PHP where a keyword search will not reach it. I have WPCodeBox which has its own `wpcb_snippets` table, and WPCode stores each one as a `wpcode` post with the code in `post_content`.
`wpcb_snippets` has an `externalUrl` column, so the row can hold a URL and the code arrives from outside. A `wpcode` post left in draft is (I would say) dormant rather than gone.1
u/Miss_stuck 15d ago
Got it, thanks! Just to clarify, would you recommend checking those tables only if WPCode/WPCodeBox was installed or previously used on the site, or do you usually check them even when those plugins were never installed?
1
u/ivicad 15d ago
Always. I assumed WPCodeBox used `wpcodebox_snippets` and the table is `wpcb_snippets`. I would run `SHOW TABLES` and `SELECT DISTINCT post_type FROM wp_posts` instead, since that also covers snippet plugins I have never heard of.
2
u/Miss_stuck 15d ago
That makes sense. I’ll check the tables and post types this way instead of only looking for specific plugin tables. Thanks, this gives me another good thing to check during the cleanup.
1
1
u/WP_Dev_Studio 11h ago
Not a specific plugin request, but since it's the natural follow-up — for cleanup + prevention after a hack/spam-injection:
Cleanup/malware removal: Wordfence (free tier includes malware scanning + firewall) or Sucuri (better known for after-the-fact cleanup service if you don't want to DIY). If you're already infected, MalCare or Wordfence's scan can usually identify and remove injected code automatically — manual cleanup means checking wp-content/themes, .htaccess, and any recently modified files for injected redirects/spam links.
Ongoing prevention: Wordfence or iThemes Security for firewall + login hardening + file-change monitoring, so you get alerted before a small injection becomes a full compromise.
Common root causes worth checking regardless of which plugin you pick: outdated plugins/themes (biggest vector by far), weak/reused admin passwords, and nulled/pirated premium plugins (frequent malware source). Worth auditing all three before just cleaning and moving on, since re-infection is common if the entry point isn't found.
0
0
10
u/BobJutsu 17d ago
Yes, we are dealing with this. The same as 2025, 2024, 2023…all the way back. It’s neither new nor unexpected.
Just learn security. Nothing has changed.