I think a lot of responses are avoiding the most realist of responses (my attempt at being funny, sort of) and hopefully this is a
@Festinger worthy-esque response.
If you're seeing pop ups on your WordPress sites that you didn't implement then your site is most likely infected/compromised or as most people would say "hacked" and I use the term "hacked" very lightly.
You'll want to consider...more likely NEED to do the following:
Perform a cleanup of the site(s) in question. This can be done fairly quickly if you know what you're doing. However, if you don't here are the steps you would want to take to perform a proper cleanup:
- Update your WordPress core files with fresh copies of that version your site(s) are using. It is crucial that you use the same version of WordPress your site(s) are running on. After updating/replacing your WordPress core files with fresh copies of the version they're running on, make sure to update WordPress to the latest version. Here is where you can download different version of Wordpress to get the core files of the version your site(s) are running on - https://wordpress.org/download/releases/ . If you do not know how to check the version of your WordPress site you can do so in the dashboard or by looking at the wp-includes > version.php file.
DO NOT replace your wp-content folder. You will lose all of your uploaded assets such as images. You will need to comb through the wp-content directory (explained down below in Step 9) for any malicious files. This is a manual process. Typically, you'll see .php files that shouldn't be in the month/year folders.
- Update ALL plugins free and premium to their latest versions. Since it sounds like your site(s) have been compromised you'll want to download fresh copies of each plugin. This way you can delete all existing folders (directories) on the hosting account for each plugin and upload a fresh copy (and latest version) of that plugin. If you're using plugin(s) that haven't been updated in over 6 months...you probably want to get rid of those or find replacement plugins that are still being updated regularly by the plugin developer.
- Download fresh copies of your current active theme files. You'll need to delete your existing theme files and re-upload the fresh copy of theme files. If your theme hasn't been updated in a long time by the theme developer, you may want to consider finding a new theme to use for your clients that is regularly updated by the theme developer.
- Check your wp-config.php for any code injections. You may want to replace your wp-config.php with a fresh copy as well. Don't forget to save your database name, user, and password to put into the new wp-config.php.
- If you're on an Apache based web server, make sure to show hidden dot files and directories and check the .well-known directory. This directory is used for things such as ACME Challenges when a SSL Certificate is being added or renewed. You might see malicious .php files that were uploaded (wacky code inside when view with a text editor).
- You might notice random .php files (e.g., afdkgarg.php or 834ed2.php) in your file system. Delete those. Those are bad.
- For all user accounts, make sure you update passwords. Also delete any user accounts that shouldn't be there or aren't being used. Sometimes "hackers" will create a new user via SQL query or directly in the WordPress dashboard if they've gained access.
- Disable the WordPress editor in the WordPress admin dashboard by placing this in the wp-config.php. If an unwanted user has gained access to your WordPress dashboard, this prevents them from editing your plugin or theme files directly in the admin dashboard (Note: there's ways around this but this will at least close off that path of destruction).
Code:
## Disable Editing in Dashboard
define('DISALLOW_FILE_EDIT', true);
- Check your wp-content directory for .php files or any other files that shouldn't be in there. a "hacked" WordPress site will sometimes have files in the upload folders (year/month) that shouldn't be there.
A tidbit about security plugins that I wanted to have a word about:
Many people recommend Wordfence (obvious market leader for a long time). Many times security plugins (in general) will sell a WordPress user on fear and don't necessarily do a good job. Wordfence, and I'm just using Wordfence here as an example, can't do a lot of manual cleaning up that should be done to properly clean your "hacked" WordPress site. Many security plugins, such as Wordfence, also enable automatic scanning features BY DEFAULT. This is bad. Because usually, the automatic scans are set to run MULTIPLE times daily. If you're on a shared web hosting account or even have your own (Reseller/VPS/Dedicated) server, the automatic scanning will eat a TON of your server's resources. This can lead to high load or degraded server performance (slow loading websites).
I'd like to mention that if you absolutely want a security plugin, for whatever reason--appeasing clients who want one or because you want one,
Defender by
WPMU DEV is a better option over Wordfence.
And to close this long response, if you're managing multiple sites you'll want to make sure to back those up regularly. Download local copies of the site files and database so that in an event like this you can restore a backup to a time when you knew things were functioning normally (and upgrade whatever needs to be upgraded). If you're looking for a backup plugin, I
HIGHLY RECOMMEND All-in-one migration by
ServMask.
If you have a lot of non-active themes and plugins installed (not being used) delete those. Those create more attack vectors and potential vulnerabilities you don't want.
