Help a brothers , someone want to hack my site

[Milagro]

Hello friends , recently noting that someone add a user to my wp account and once I delete the user is will generate new one automatic

I have tried to delete the user for phony admin , but is coming back with new Id now is on ID 3O once I delete it will come back with ID 31

please I need help on how to delete this user completely from my site

 

[davids355]

Are they being created as a subscriber or an admin?

Might be worth looking at the Malcare plug-in.

 

[693840]

Remove all your plugins and themes, and install legitimate ones that you buy instead of downloading nulled versions with malware inside of them. Problem will be solved instantly.

 

[dheer]

If you are the admin of your server I would recommend you to scan it with ClamSCAN and ImunifyAV and gather all the infections and manually delete any malicious code you find in your WP files. There are worst malware creating such issues.

 

[Milagro]

Are they being created as a subscriber or an admin?

Might be worth looking at the Malcare plug-in.

They are created it as an admin

Remove all your plugins and themes, and install legitimate ones that you buy instead of downloading nulled versions with malware inside of them. Problem will be solved instantly.

okay i will try it

If you are the admin of your server I would recommend you to scan it with ClamSCAN and ImunifyAV and gather all the infections and manually delete any malicious code you find in your WP files. There are worst malware creating such issues.

okay I will try it out

 

[awesomewebsites]

Take professional help, you can hire someone on BHW.

 

[Mr Positive]

1) hide my wordpress login use that plugin, chnage password, log out everywhere else, install wordfence you’ll see his ip block that entire range

 

[Nasus]

Contact your host as well, they might have an anti-malware solution for you and some can even do it for free

 

[chrono01]

if you have nulled themes/plugin better to remove them.
or if you want you can manually check it by enabling or disabling if they are the one causing it.

if u use cloudflare, use their firewall(restrict access to wp-admin/*) and whitelist only your IP
change all your password, root and admin
use some linux AV and fail2ban (whitelist your IP)
change all the default ports you have

 

[MisterXYZ]

Seems like a backdoor entry through nulled plugin or theme.

Better remove those plugin nd theme.

Also take backup of wordpress and do a fresh installation.