Solve the problem of unknown PHP files and unknown vps user names being added to the WordPress website

In response to a netizen's request to help him deal with problems with his WordPress website, he informed that his website had only been updated for a few months, but found that the Internet speed was relatively slow, and the included content was strange and was not the content of pages updated by his own website. . So I checked and found that many strange PHP file pages had been added to the root directory of the website and other directories, and in the website user administrator, I saw that there was another administrator account besides his own account.

Actually, he saw this problem last week, but the website could be accessed normally. He also deleted these unknown files through file managers and FTP tools, as well as deleted unknown user administrators, but after two days, This problem still occurs. We have encountered this type of problem before, usually due to unknown theme and plug-in problems. Our theme needs to be genuine and the plug-in needs to be the latest version.

The snail here helped him solve the problem, but it has not yet been found whether it can completely solve the problem. I will record the process of helping him solve the problem here. It would be best if you solve the problem later. If the problem is not solved, then check what caused the problem.

First, do you need to reinstall the server environment

Because there are no problems with the other three websites in the same server (BT panel environment), but there is a problem with one website. I won't help him change the system and reinstall the WEB for the time being, otherwise it will take a lot of time. After all, there are no problems with the other three websites, and the security issues of the server can be ignored for the time being.

Second, upgrade the confident version of WP program

Online updates are not used here, but all files are deleted, except for the wp-content folder and wp-config.php file. For those of us who are unclear about this, you can make a backup first. All are replaced manually to replace the latest program of the website. Then upgrade to the latest WP program.

Third, replace the latest theme and reinstall all plug-ins

This theme is what he has been using, and of course there is no latest version. Since he wants to use it, he will still use the earliest version. I originally suggested changing to the WP official free theme or a paid theme. Get over this first. But for plug-ins, I uninstalled and deleted all plug-ins, and then reinstalled several plug-ins with a large number of users. Unofficial plug-ins and unknown plug-ins were not installed.

Fourth, check the uploads file

Check the files in uploads here, and of course check all folders. I saw that there are many PHP files and non-image files in the Uploads folder. These are probably the files that were uploaded. Check them one by one and delete them.

Finally, delete the unknown administrator user and change the password of your own administrator. Also change the password for the website database. After completing the replacement, wait a few days to see if there are any problems.

Recommended site searches: Hong Kong server, free mainland China space, domain name registration website US host network, dynamic IP dial-up server, free server domain name check, Beijing domain name registration, registration information query, ICP website registration,