You can use the REST API to list users: /wp-json/wp/v2/users Add that to the end of your website URL. Plugins such as Wordfence can prevent anonymous users from accessing this. You can also disable the REST API if you do not use it.
The only way that I have found (and used) to get rid of ‘unauthorized’ code is to manually check everything. This includes changing access credentials for hosting, ftp, databases, admin-level users. Strong passwords, of course. reinstalling everything (themes, plugins, custom code) from known good sources via a manual FTP process. Also, reinstalling WP from the … Read more
A couple of options file sharing, wherein the two servers can access some of the same files. The details vary according to the VPS technology used — talk to your webhost. See also https://serverfault.com/questions/369080/is-it-possible-to-share-files-between-multiple-vps file syncing, wherein the two servers have separate copies of the files, but the copies are kept in sync. Here I’d … Read more
Add some AJAX actions in your plugin file, something like this… The first one (without _nopriv) will already only be executed for logged in users, and the second will only be executed for logged out users, so there is no need to retest is_user_logged_in() here: add_action(‘wp_ajax_show_popup_contents’, ‘show_popup_contents’); function show_popup_contents() { $filepath = dirname(__FILE__).’/popup.php’; include($filepath); exit; … Read more
I suspect that there is malware files on your system that is allowing those user registrations. There are lots of googles/bings/ducks on how to clean a hacked system. (I use my own procedure here.) What I would do is these things: change all credentials everywhere (hosting, FTP, admin etc) create a new admin user with … Read more
There are many precautions you can (and should) follow. Select good hosting/server. Set strong passwords for your hosting and FTP accounts. Don’t use servers that allow remote connections to the DB. If you want to host multiple sites on one server, make sure they’re separated (so one site can’t access files from other sites – … Read more
how to add security questions on wp-registration page and validate it
“Fire Secure” menu item
That’s not going to stop the spammer, IMHO. Spmmers don’t even use your comment form. They ‘scrape’ the form (maybe, not required), and ‘post’ via a CURL process that sends the form fields. They don’t even have to visit your site – all they need for a comment post is the post ID. And that … Read more
check_ajax_reffer not working when logged