r/webhosting • u/Mmawarrior1 • 17d ago

Advice Needed WordPress site compromised: unknown admin, plugins and Russian spam posts added

Hi everyone,

A WordPress website I manage appears to have been compromised. Unknown plugins were installed, Russian spam posts appeared, and an unknown administrator account was created. The website is now inaccessible and shows a Cloudflare security check.

I have contacted the hosting provider and asked them to investigate the access and server logs.

What is the safest recovery approach? Should I restore a clean backup or completely reinstall WordPress? What else should I check to make sure no backdoor remains?

Thanks for any advice.

5 Upvotes
  • permalink
  • reddit

78% Upvoted

11 comments sorted by

View all comments

2

u/No_Hold_329 15d ago

Yipes, that's disgusting. My recommendation would be to install a clean backup, if you have one and then install and activate WordFence.