DDoS Attack After Switching Hosts and Updating WordPress

Question

I recently moved an old WordPress site from one hosting to Amazon Lightsail. Once the transfer was done, I noticed that WordPress, its plugins, and themes were all out of date. So, I updated them all. All good after that.

Then, within a day, a user "wordcamp" was registered on WordPress using the email [email protected]. Did a bit of googling and found this: https://wordpress.org/support/topic/my-wordpress-site-got-hacked-by-someone/. So, I deleted that user, updated the passwords of the legitimate users of the site.

I also installed WordFence, which detected suspicious files on the server. I do not know if those files were already on the old WordPress site and copied over to Amazon Lightsail - or if they appeared around the time that mysterious user registered on the site. Deleting those files somehow broke the site, so I undeleted them hoping that WordFence would be enough to keep the site going until such time we replace it with a completely fresh WordPress install and configuration.

Unfortunately, sometime shortly after, no one could connect to the site. WordFence reported about 80,000 connection/login attempts over the previous 24 hours.

HOW I TRIED TO RECOVER

1. I was able to SSH into the server and put it under maintenance mode in an attempt to reduce the number of pages the site was serving; reduce the load
2. I deleted all the suspicious files reported by WordFence
3. I moved the site to an Amazon Lightsail instance with more memory resources
4. Since I was using CloudFlare, I put it in DDoS mode for the site
5. I installed Google reCaptcha v3
6. I changed the login URL
7. I disabled xmlrpc.php

The site is currently running with CloudFlares "under attack" mode. CloudFlare reports about 5-10 connection attempts blocked per minute (all from different IPs from around the world). They're all trying to connect to:

• wp-login.php (which now redirects to the homepage)
• xmlrpc.php (which now returns a 403)
• wp-cron.php (with query string like ?doing_wp_cron=1593059462.9016170501708984375000; I haven't done anything to address this)
• the rest are random pages on the site

Any ideas what might have happened? The timing is so suspicious. I move the site to Amazon Lightsail, upgrade everything, put it on CloudFlare -- and then I get a DDoS attack? When it was on the old hosting with outdated software, everything was good. It's baffling.

Any suggestions what I can do?

Answer 1

I suspect your site was already hacked due to outdated plugins/themes/WordPress core, etc. The hacker may already had access. Now someone is trying to find the login details of your WordPress admin. Cloudflare does fantastic job to prevent such kind of attacks. Since the attack is coming from different IPs, blocking them is impossible. What I would like to suggest is check all the files once again, even the legit files. Check if there are any cronjobs running, check if there is any temp suspicious files, check if any python or perl script running.

Further, I would also suggest you to change the admin url to something else and rename xmlrpc.php or entirely disable it.

If this does not help, then remove everything, fresh install the WordPress, copy your theme, download all the plugins from the known source, copy uploads folder and check if there are any suspicious PHP files or any other files than images, pdfs, etc. Install malware scanner plugin and scan your theme and uploads folder.

Hope that helps.