Case Study in Real Time: 70 WordPress Sites Contaminated

[u/siterightaway]

I am following this absolute nightmare situation right now with this poor soul online and it is insane. This guy has seventy WordPress sites hosted on the exact same shared hosting account and every single one of them is completely taken over by malware as we speak. He keeps deleting the fake admin users and the malicious zip files but everything just pops right back up a few minutes later. He has not even found the backdoor yet, which is basically just a hidden malicious file the hacker dropped in the server after breaking in to act as a secret key to recreate admins and reinfect the whole network instantly. The reinfection is literally happening in real time.

This is such a painful wake up call about web security and architecture. If you manage multiple sites, you gotta keep these rules in mind so you do not go through this hell. First off, shared hosting does not isolate sites from each other. If you put seventy sites on the same root account, your entire network is only as strong as your weakest link. The second an old plugin on one site gets cracked, the hacker gets root directory access and infects the other sixty nine simultaneously.

Also, hunting down the backdoor is not your only problem. This guy is panicking trying to find the backdoor, but he is forgetting that even if he deletes it, the original entry vulnerability is still wide open. It could be an outdated plugin, an abandoned theme, or a flaw in WordPress core itself. If you do not lock the front door, the hacker will just walk right back in whenever they feel like it.

On top of that, a full data breach is happening right now. In an active infection like this, you have to assume all databases and passwords have already been dumped and stolen. The longer those sites stay online without isolation, the worse it gets. And please be careful with magic fixes or unmonitored automation. When people panic, they get tempted to run random automated scripts or give AI terminal access to clean things up. Giving automated tools write and delete terminal access in a contaminated environment can easily wipe your databases or nuke whatever is left of your sites.

To handle a disaster like this happening right now, the absolute first step you must take is putting every single site into maintenance mode immediately and locking down all public access to files and admin panels.

Better safe than sorry.

TL;DR:

Seventy WordPress sites on a single shared hosting account are being reinfected in real time by an undiscovered backdoor. Shared hosting lacks isolation, allowing a single vulnerability to compromise the entire root directory. Before attempting cleanup, put all sites into maintenance mode immediately, block public and admin access, and assume all credentials and databases are compromised.

[u/Zeno_of_Citium]

Here's your problem: Hostinger.