How to get back into a hacked Wordpress site

[Conor]

I've learnt a couple of pretty basic but useful things when it comes to Wordpress logins over the years. The sad truth is that due to the popularity of Wordpress, hackers have learnt a few things over the years too. Lucky for us, it's quite quick and simple to get back into a Wordpress site that's been hacked. So let's start:

Trick 1 - Changing the admin password in the database
This is the simplest way of doing it. Just access your database via PHPMyAdmin.

Navigate to the wp_users table, locate the admin user and click the Edit (pencil) icon.

Now, just type a recognisable password into the "user_pass" column, click the "Function" dropdown for that same column, and change it to "MD5" to encrypt the password.

Click "Go" to save your changes. You should be able to log in to your WP site properly again.

Trick 2 - Creating a new admin account in the database
(Credit for this trick goes to these guys.)
Click on your database in the left sidebar in PHPMyAdmin, and then click the "SQL" button at the top.

Paste the following code into the big text box that appears:

INSERT INTO `wp_users` (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_status`)
VALUES ('newadmin', MD5('pass123'), 'firstname lastname', '[email protected]', '0');

INSERT INTO `wp_usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`)
VALUES (NULL, (Select max(id) FROM wp_users), 'wp_capabilities', 'a:1:{s:13:"administrator";s:1:"1";}');

INSERT INTO `wp_usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`)
VALUES (NULL, (Select max(id) FROM wp_users), 'wp_user_level', '10');

You'll need to change the code in red to your Username, Password, Name/Surname and email respectively.

The code in green is your database prefix. Make sure this matches your actual DB prefix, which is usually "wp_".

You're done! Just click "Go", and you should now be able to log into Wordpress with your brand new admin account.

Trick 3 - Accessing phpMyAdmin via WAMP
(Credit to this guy)
This one is pretty cool I think. You don't actually need access to cPanel, as long as you can get into the root FTP directory. Go to your wp-config.php file and make a note of the following values in red:

/** The name of the database for WordPress */
define( 'DB_NAME', 'database_name_here' );

/** MySQL database username */
define( 'DB_USER', 'username_here' );

/** MySQL database password */
define( 'DB_PASSWORD', 'password_here' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

Go to your WAMP directory and locate config.inc.php in your phpmyadmin folder. (Mine is located at \wamp64\apps\phpmyadmin4.6.4\)

Paste the following code at the bottom of your file (Before the closing ?> tag of course):

$i++;
$cfg['Servers'][$i]['localhost'] = '';
$cfg['Servers'][$i]['username_here'] = '';
$cfg['Servers'][$i]['password_here'] = '';
$cfg['Servers'][$i]['auth_type'] = 'config'; // This is the authentication mode. Since we are doing this on localhost, it is safe to set is as config. You can read more about authentication types available here: https://wiki.phpmyadmin.net/pma/auth_types

Save the file and start WAMP. Navigate to localhost/phpmyadmin in your browser.

You should then see a dropdown, select your server and enter the username and password and you're in! No need for cPanel!

 

[Gogol]

Good post @Conor.
Can I add a basic point to this?
Everyone, please for Dog's sake, use git and have a log of your project in your server. That way, any malicious changes and/or any addition/deletions of files could be tracked very easily.

My two cents

 

[LGNDFRVR23]

If you have acces to your cpanel you can add this code in your theme’s folder/ functions.php and it will create an admin user. Worth to add it to this guide.

function wpb_admin_account(){
$user = 'Username';
$pass = 'Password';
$email = '[email protected]';
if ( !username_exists( $user )  && !email_exists( $email ) ) {
$user_id = wp_create_user( $user, $pass, $email );
$user = new WP_User( $user_id );
$user->set_role( 'administrator' );
} }
add_action('init','wpb_admin_account');

 

[Conor]

Good post @Conor.
Can I add a basic point to this?
Everyone, please for Dog's sake, use git and have a log of your project in your server. That way, any malicious changes and/or any addition/deletions of files could be tracked very easily.

My two cents

Great advice. I'd definitely be interested to read more about your workflow actually!

 

[Gogol]

Great advice. I'd definitely be interested to read more about your workflow actually!

I can post mine, but not sure if I am qualified enuff . Great to see that someone that I have worked with is actually interested. I might post one after this lol

 

[Conor]

I can post mine, but not sure if I am qualified enuff . Great to see that someone that I have worked with is actually interested. I might post one after this lol

You've posted some great stuff in the past Of course you're qualified enough.

 

[Gogol]

You've posted some great stuff in the past Of course you're qualified enough.

hehe ok I have the confidence now I will post my workflow this weekend