When your WordPress website is compromised you need to do one or more of the following:
- Restore from a backup
- Completely remove a virus
- Change hosts
- Have someone maintain your website on a continual basis
- Update your website
- And more…
One thing that many novices may overlook is how to completely reset your passwords. Below is a handy list of passwords you should reset:
- Domain Name Registrar account. You probably don’t need to reset this password. If someone has taken control of this you have bigger issues.
- Hosting account. Again, you probably don’t need to reset this password, but it is a smart idea – just to be on the safe side.
- Cpanel. Many shared hosting accounts will provide you with a cPanel or other administrative portal. This password is sometimes shared with your FTP account and should be reset
- FTP. You should reset the passwords for all FTP accounts attached to your account – just in case one was compromised.
- WordPress. All Administrative (and possibly other) accounts should have their passwords reset to be highly secure. This is not always convenient and you may not think people are trying to hack your account so it doesn’t matter, but they have robots. Not your friendly C3PO robot, not a bored teenager, but a nasty script running on a server that is trying to type in every password combination to get into your site. It is scouring the internet for WordPress login interfaces and trying as many password combinations as they can get away with. You might be a small fry, but if they can gain access to your account, they can use your server for other malicious activities.
- MySQL. You need to create a new MySQL user and give it permissions for your WordPress database. Then you need to update your wp-config.php file with the new credentials. Lastly you should disable the old MySQL user. If they gained access to your website, they may have been able to pull your database credentials from your config file. Maybe not, but it is good to err on the side of caution
- Lastly, update your salts to kick out any currently logged in users and you should be in good shape.
The entire password resetting process will likely take roughly 30 minutes, depending on the current passwords and providers.
