I recently moved an old WordPress site from one hosting to Amazon Lightsail. Once the transfer was done, I noticed that WordPress, its plugins, and themes were all out of date. So, I updated them all. All good after that.
Then, within a day, a user "wordcamp" was registered on WordPress using the email email@example.com. Did a bit of googling and found this: https://wordpress.org/support/topic/my-wordpress-site-got-hacked-by-someone/. So, I deleted that user, updated the passwords of the legitimate users of the site.
I also installed WordFence, which detected suspicious files on the server. I do not know if those files were already on the old WordPress site and copied over to Amazon Lightsail - or if they appeared around the time that mysterious user registered on the site. Deleting those files somehow broke the site, so I undeleted them hoping that WordFence would be enough to keep the site going until such time we replace it with a completely fresh WordPress install and configuration.
Unfortunately, sometime shortly after, no one could connect to the site. WordFence reported about 80,000 connection/login attempts over the previous 24 hours.
HOW I TRIED TO RECOVER
- I was able to SSH into the server and put it under maintenance mode in an attempt to reduce the number of pages the site was serving; reduce the load
- I deleted all the suspicious files reported by WordFence
- I moved the site to an Amazon Lightsail instance with more memory resources
- Since I was using CloudFlare, I put it in DDoS mode for the site
- I installed Google reCaptcha v3
- I changed the login URL
- I disabled xmlrpc.php
The site is currently running with CloudFlares "under attack" mode. CloudFlare reports about 5-10 connection attempts blocked per minute (all from different IPs from around the world). They're all trying to connect to:
- wp-login.php (which now redirects to the homepage)
- xmlrpc.php (which now returns a 403)
- wp-cron.php (with query string like
?doing_wp_cron=1593059462.9016170501708984375000; I haven't done anything to address this)
- the rest are random pages on the site
Any ideas what might have happened? The timing is so suspicious. I move the site to Amazon Lightsail, upgrade everything, put it on CloudFlare -- and then I get a DDoS attack? When it was on the old hosting with outdated software, everything was good. It's baffling.
Any suggestions what I can do?