how to find the way they hacked my WP site

There are many things that I do to check a possible hack on the site. Changing FTP users/passwords, reinstalling WP, reinstalling themes/plugins, changing user account passwords (especially admin level), change hosting credentials.

I wrote an entry on my own site to remind me (most of the stuff there is my own ‘notes’ to myself). May be helpful: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ (Not trying to promote my site; there are many googles on how to recover from a hacked site. That link is just my personal list.)

Related Posts:

  1. Verifying that I have fully removed a WordPress hack?
  2. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  3. Tips for finding SPAM links injected into the_content
  4. What should I do about hacked server?
  5. How can I find security hole in my wordpress site?
  6. How to prevent bot or someone to modify any file automatically?
  7. wp-config.php modified?
  8. Suspicious Files
  9. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  10. Malware script in database post table only? [closed]
  11. Verifying that I have fully removed a WordPress hack?
  12. How can I safely hide the fact that my website runs on WordPress? [closed]
  13. My WordPress Websites are always under attack
  14. How to find exploited wordpress plugin [closed]
  15. Any known bugs that could cause disappearance of the wp_users table?
  16. On new server, site got hacked, permissions a bit strange? Please help
  17. Replace domain in database
  18. Remove hacked code – out of ideas! [closed]
  19. WordPress Database Re-installed (Hacked)
  20. Verifying that I have fully removed a WordPress hack?
  21. Could a user account with a stolen password compromised entire WP site?
  22. How to stop repeated hack on header.php of custom theme? [closed]
  23. Is my WP site being hacked?
  24. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  25. WordPress Hacks/Defacing [closed]
  26. What is the difference between a cer, pvk, and pfx file?
  27. Is it possible to decrypt SHA1
  28. Why should I use the esc_url?
  29. Why escape if the_content isnt?
  30. Full path disclosure on rss-functions.php
  31. What to use instead of wp_kses() in user output
  32. Are the default salts secure?
  33. is_email() VS sanitize_email()
  34. How to escape custom css?
  35. Understanding SVG vulnerabilities in WordPress related to a specific fix
  36. Moving wp-config.php: Can this be done after site launch?
  37. How to secure or disable the RSS feeds?
  38. How to get WordPress to save upload file beyond web root [closed]
  39. Is security a problem in WordPress?
  40. Moving wordpress out of the public directory
  41. Logout via Subdomain, non-wordpress page on a different server?
  42. How can I tell who changed the password?
  43. WordPress website Security [closed]
  44. Can’t reset WordPress password
  45. Is the “lost password” feature truly a vulnerability?
  46. Frontend Password change
  47. Is it possible to reduce the minimum character length for passwords?
  48. Handling email piping attachments and detecting unsupported file types
  49. Is it good security advice to install wordpress in subdirectory but link to root?
  50. Why was my blog post inserted lot’s of ad links by others?
  51. How Could I sanitize the receive data from this code
  52. WordPress SQL Injections through User Agent
  53. Should I Worry About SQL Injection When Using wp_insert_post?
  54. Is there a way for a user to have an alias?
  55. What permissions should I give directories if I want to make WordPress more secure?
  56. How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
  57. Security threat with `home_url`?
  58. When is wp_set_password() called or how to capture a password
  59. Something is unescaping all html entities before output to browser [closed]
  60. Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
  61. How to get WordPress to send Password Reset Link Email instead of New Password?
  62. Large Session Tokens
  63. How to change permissions of WordPress and/or apache on macOS securely?
  64. Using an Encryption class in a WordPress Plugin
  65. Safe to say WordPress security releases don’t have database upgrades
  66. Config file with no Keys..?
  67. How much should I worry about these messages?
  68. Security concerns with external links
  69. Efficient way to check local WordPress php files and Database for malicious code? [duplicate]
  70. Uploading .webm format on WordPress results in security guidline breach and fail
  71. fail2ban to prevent Brute Force Attacks on WordPress?
  72. .htaccess password protection bypassed
  73. Session Cookie security questions
  74. How to give the same error message when the wrong password or wrong username is used?
  75. Storing FTP details in wp-config.php
  76. Spam injected in w3 total cache page cache [closed]
  77. Website show Google Ads when we have no Google Ads linked to our website
  78. How to distinguish between a hack and an encoding error?
  79. Prevent editor from adding script or form
  80. How to change location of wp-config.php to folder or 2 folders up?
  81. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  82. Finding where a snippet of code is coming from
  83. Secure Server after configuration
  84. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  85. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  86. Security: Critical backend outside of wordpress
  87. Advice On How to Backup WordPress
  88. How to check whether a site has been compromised without browsing into it?
  89. My site thinks it’s secure when it is fact not
  90. Is it possible to only have the admin interface bind to the local loopback?
  91. Should I change the default file and folder permissions?
  92. WordPress exploited theme is causing high io load on server
  93. How to rewrite rules for WP-security in Nginx?
  94. Default installation permissions for wp-config.php
  95. Correct setup to block file modifications from hackers
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH