what the hells happened to my website?
Discussion
Long story short is my website was 'looked after' by someone who did a great job of building it but they never showed me how to update it, they had several spelling mistakes, old pictures which were mixed up in a terrible order and basically meant i couldn't do anything.
New year i thought right I'm going to get this sorted, got a local company to take it over.
All taken over great. Well no, i asked if i could get my Facebook feed put directly on the site, asked for them to change a couple of things.
Nope.
We don't do wordpress.
So i had a go, i updated the spelling mistakes, the wrong address and several gallery pictures. Managed to get my Facebook reviews on there as well, although for some reason they come up on a gallery page and not home. I also wrote a new page which when in admin shows my text and says its live. On the website though theres no trace of it? i also from today seem to have lost the sliding gallery on the home page which was there 2 days ago, i wanted to change it but couldn't find a way to so i don't know how whats happened even has.
Biggest problem is though is i just went to log in again and some sex cam site came up, then again then i got on. Tried logging in and it wont let me, just takes me to a page with nothing but a box which says password and submit. doesn't work at all, i can't seem to get into the admin area.
Tried again from a phone and it took me to skybet first then second attempt to my site. Tried from my phone, wife phone and iPad and from these devices it goes to skybet first. hestview ltd is the name in the bar at the top.
So whats going on, I'm guessing its been hacked maybe. How can i sort this? I've emailed the website people so will await their response.
What a load of b
ks. makes me think i should give one of the numerous people who cold call all the time selling their web services a try. second 'proper' company I've been to and both seem fairly useless 
address is
www.williamspaving.co.uk (obviously beware that if logging in from a work computer it might not be safe).
New year i thought right I'm going to get this sorted, got a local company to take it over.
All taken over great. Well no, i asked if i could get my Facebook feed put directly on the site, asked for them to change a couple of things.
Nope.
We don't do wordpress.
So i had a go, i updated the spelling mistakes, the wrong address and several gallery pictures. Managed to get my Facebook reviews on there as well, although for some reason they come up on a gallery page and not home. I also wrote a new page which when in admin shows my text and says its live. On the website though theres no trace of it? i also from today seem to have lost the sliding gallery on the home page which was there 2 days ago, i wanted to change it but couldn't find a way to so i don't know how whats happened even has.
Biggest problem is though is i just went to log in again and some sex cam site came up, then again then i got on. Tried logging in and it wont let me, just takes me to a page with nothing but a box which says password and submit. doesn't work at all, i can't seem to get into the admin area.
Tried again from a phone and it took me to skybet first then second attempt to my site. Tried from my phone, wife phone and iPad and from these devices it goes to skybet first. hestview ltd is the name in the bar at the top.
So whats going on, I'm guessing its been hacked maybe. How can i sort this? I've emailed the website people so will await their response.
What a load of b
ks. makes me think i should give one of the numerous people who cold call all the time selling their web services a try. second 'proper' company I've been to and both seem fairly useless address is
www.williamspaving.co.uk (obviously beware that if logging in from a work computer it might not be safe).
Edited by m3jappa on Thursday 22 February 19:25
WordPress is notorious for being hacked especially if no-one is updating and maintaining it.
It's always safer to wipe the site and set it up from scratch if you / your host can. You'll never be sure that's it's safe and secure if you just try to clean it, and if it keeps getting hacked / prompting popups, you just causing damage to your brand and loosing potential customers.
It's always safer to wipe the site and set it up from scratch if you / your host can. You'll never be sure that's it's safe and secure if you just try to clean it, and if it keeps getting hacked / prompting popups, you just causing damage to your brand and loosing potential customers.
m3jappa said:
no but have emailed them. What a mess, is it easy for them to fix?
Have you managed to speak to them yet? It's difficult to say how to fix it as don't know what happened, could be you're running an old version of WP, an outdated plugin or a poorly constructed theme that the virus has exploited. Your host will scan your files and give you some idea as to what has happened and a way forward. Might just be best to start again with a clean WP install, fresh and well constructed theme / plug ins and add your content back in again. WP is great but needs monitoring to ensure everything is up to date and secure.
You should also run a virus scan on all of your devices to make sure they're OK.
Depending on your host you might be able to recover this quite easily.
You host will probably take a daily snapshot of your site and back it up. So they should be able to reinstate an old back up and return everything to normal.
If you intend to DIY the next step you need to do is install Wordfence to protect yourself from further attacks.
Then remove any user accounts that aren't active or needed.
Change the admin account user name to something other than admin and set up a long string password.
Turn off the ability for randoms to comment and register if its not needed.
Get updraft and then back the site up to a Google drive or your PC. At least if you get hit again you have a copy and can then use Updraft migrator or similar to bring your site back if for any chance your host cant help you.
Once you have done all of this it might be worth going through your plugin list and updating any old plug ins and deleting any that aren't in use. Then updating Wordpress to the latest version. Be aware though that doing both of these might upset your site if the template / plug ins aren't compatible with the latest version of Wordpress. If you have taken a back up prior to this then you can wind everything back and establish where the issue lies.
You host will probably take a daily snapshot of your site and back it up. So they should be able to reinstate an old back up and return everything to normal.
If you intend to DIY the next step you need to do is install Wordfence to protect yourself from further attacks.
Then remove any user accounts that aren't active or needed.
Change the admin account user name to something other than admin and set up a long string password.
Turn off the ability for randoms to comment and register if its not needed.
Get updraft and then back the site up to a Google drive or your PC. At least if you get hit again you have a copy and can then use Updraft migrator or similar to bring your site back if for any chance your host cant help you.
Once you have done all of this it might be worth going through your plugin list and updating any old plug ins and deleting any that aren't in use. Then updating Wordpress to the latest version. Be aware though that doing both of these might upset your site if the template / plug ins aren't compatible with the latest version of Wordpress. If you have taken a back up prior to this then you can wind everything back and establish where the issue lies.
You've been hacked and now know why professional web agencies/developers don't use wordpress.
There are plenty of plenty of free and inexpensive templates for responsive websites that will not suffer the same security risks as wordpress or similar content management systems.
Your hosting ISP should be able to help you clear down the compromise.
There are plenty of plenty of free and inexpensive templates for responsive websites that will not suffer the same security risks as wordpress or similar content management systems.
Your hosting ISP should be able to help you clear down the compromise.
I don't really understand how you "got a local company to take it over" and then later found out they don't do Wordpress? Makes no sense - what exactly did they take over?
Wordpress is OK but you must stay on top of the updates. Using a security plugin is almost mandatory these days I think.
Wordpress is OK but you must stay on top of the updates. Using a security plugin is almost mandatory these days I think.
miniman said:
4x4Tyke said:
You've been hacked and now know why professional web agencies/developers don't use wordpress.
Of course they do. Mickey Mouse agencies don't know how to secure and maintain it properly. ... and the dangers of listening to the amateurs here
https://nakedsecurity.sophos.com/2013/09/27/how-to...
https://nakedsecurity.sophos.com/2013/09/27/how-to...
Gassing Station | Business | Top of Page | What's New | My Stuff