Have you identified the exploit vector? If not, you may be leaving yourself open to future exploit.
Other things to consider:
- Change WordPress admin user passwords – done
- Change Hosting account user password
- Change FTP passwords
- Change MySQL db user password – done
Change the db table prefix- Update your wp-config nonces/salt
- Check your directory/file permissions
- Block directory-browsing access, via
.htaccess - Go through everything in the Hardening WordPress Codex entry
- Go through everything in the FAQ My Site Was Hacked Codex entry
Related Posts:
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Tips for finding SPAM links injected into the_content
- What should I do about hacked server?
- How can I find security hole in my wordpress site?
- How to prevent bot or someone to modify any file automatically?
- wp-config.php modified?
- Suspicious Files
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- Malware script in database post table only? [closed]
- Verifying that I have fully removed a WordPress hack?
- How can I safely hide the fact that my website runs on WordPress? [closed]
- My WordPress Websites are always under attack
- How to find exploited wordpress plugin [closed]
- Any known bugs that could cause disappearance of the wp_users table?
- On new server, site got hacked, permissions a bit strange? Please help
- Replace domain in database
- Remove hacked code – out of ideas! [closed]
- WordPress Database Re-installed (Hacked)
- Verifying that I have fully removed a WordPress hack?
- Could a user account with a stolen password compromised entire WP site?
- how to find the way they hacked my WP site
- How to stop repeated hack on header.php of custom theme? [closed]
- Is my WP site being hacked?
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- WordPress Hacks/Defacing [closed]
- What is the difference between a cer, pvk, and pfx file?
- Is it possible to decrypt SHA1
- Why should I use the esc_url?
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Where to securely store API keys and passwords in WordPress?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- Are the default salts secure?
- Is there a way to force ssl on certain pages
- Subscribe to email for security fixes?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- How to secure or disable the RSS feeds?
- Regular security checks – what steps should be included?
- Do Cookies Need to be Sanatized Before Being Saved?
- Make password invalid once logged out of password-protected page
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- Disallow file edit not preventing plugin install
- Protecting HTML5 video [closed]
- Websites defaced by uploading script using theme editor
- Does WP show me if I’m logged in from multiple locations?
- Do I need to use the esc_html() function on hard coded links?
- Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
- WordPress Malware Problem help! [duplicate]
- Frontend Password change
- Restrictive File Permissions
- Downloading File from Outside Web Root
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- site get login attempts after htaccess ip restriction
- Is it good security advice to install wordpress in subdirectory but link to root?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- How to save iframe tag into a post?
- What permissions should I give directories if I want to make WordPress more secure?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Renaming install.php for security?
- Limit Login Attempts BEFORE PHP is executed?
- Safe to say WordPress security releases don’t have database upgrades
- What can I do when an outside party hacks into my weblog and changes my display name?
- fail2ban to prevent Brute Force Attacks on WordPress?
- Use Google authentication for pages within a website [closed]
- How to give the same error message when the wrong password or wrong username is used?
- Website show Google Ads when we have no Google Ads linked to our website
- should I escape a literal url added in functions.php
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
- Secure Server after configuration
- Uploading attachment (pdf) and prevent download for anonymous user
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- Specific Page/Post Need to Stay Non SSL
- Should I prevent access to .htaccess and wp-config.php files?
- Block JSON access over the net
- Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
- The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
- Security: AWS (shared hosting) claims template file malicious
- Replacing nav-menus.php file with standard clean one?
- How to check whether a site has been compromised without browsing into it?
- My site thinks it’s secure when it is fact not
- Is it possible to only have the admin interface bind to the local loopback?
- Default installation permissions for wp-config.php
- Correct setup to block file modifications from hackers
- Directory to store secure file
- How can I give someone server access to only duplicate and modify a site?
- How can I implement ansible with per-host passwords, securely?
- Does drilling a hole into a hard drive suffice to make its data unrecoverable?
- Can you alter the default wordpress strong password requirements?
- how to sanitizing $_POST with the correct way?