How My Website Got Hacked and How I Recovered It

In yesterday’s post, I mentioned that my website got hacked in July 2022. In today’s post, I will share how it happened, what exactly I did to recover from this hack, and the security measures I took to prevent such incidents.

In the first week of July, one of my team members told me he could not log into his Author account. He sent me a screenshot of an error page saying login is not allowed.

I thought it would be a server-side bug and asked him to wait a few minutes. After it, I tried to log in with my administrator account, but even I could not log in.

I immediately contacted my hosting company. The support staff somehow resolved the issue, and I could log in. But when I logged in, I saw an unknown Admin account. I thought the support team had created this account to resolve my issue. So, I deleted that admin account and got busy with work.

After a couple of days, I received several emails from Search Console. All of them pointed out several issues with my website. When I checked those errors, I was shocked. My website had 200k unknown pages redirecting to phishing sites.

I was still unaware that my website was hacked. I contacted the hosting support team and asked them to look into it. The support staff told me your website security is compromised, and the core files are not passing the security check.

It was the time when I first came to know that my website was hacked. The support team suggested restoring the oldest backup I have.

The hack happened around 5 July, and the oldest backup was on 23 June, so I was sure the malicious codes would be removed from my site. So, I did the same, checked the backup records, and restored the oldest backup.

After restoring the backup, I contacted the support team and asked to run the security check; this time, the core files passed the security scan. Finally, my site was safe.

But I still had some doubts, so I started researching a better way to get rid of website hacks.

I discovered a solution myself. What I did was created a new WordPress installation. And on the old install, I installed a plugin called Export Media with selected content.

After it, I exported all the text content with their images attachment. Then I imported the export file into the new WordPress installation. I got all my content with their images back, leaving everything else on the old install.

Now, I was 100% sure my site was safe from hacking.

After it, I took several security measures. First, I hid the WP Admin page and installed the Wordfence security plugin. Most importantly, I blocked XML-RPC requests.

It is a back door that hackers use to Brute Force Attacks on a site. I recommend you guys to also implement these measures to keep yourself from hacking.

That’s it for this post. In tomorrow’s post, I will write about my experience buying an expired domain for $235, only to find that it has a manual penalty from Google.

Thanks for reading this post. Have a great day!