To solve the problem of adding unknown PHP files and unknown user names to the WordPress website

At the request of a netizen, he helped him deal with the problem of his WordPress website. He told him that his website had only been updated for a few months, but found that the network speed was relatively slow and the content included was strange. So I found that there were many strange PHP file pages added to the root directory of the website and other directories through my own inspection, and there was another administrator account besides his own account in the website user administrator.

In fact, he saw this problem last week, but the website was able to access normally, and he also deleted these unknown files through the file manager and FTP tools, as well as the unknown user administrators. However, this problem still occurred two days later. This kind of problem has been encountered before, usually due to unknown themes and plug-ins. Our themes need to be genuine and plug-ins need the latest version.

Here Lao Zuo helped him solve the problem, but I haven't found out whether he can solve the problem completely. I record the process of helping him solve the problem here. If it is best to solve the problem later, and if it is not solved, then check what the problem is.

First, whether to reinstall the server environment

Because the other three websites in the same server (BT panel environment) have no problems, only one website has problems. I won't help him replace the system and reinstall the WEB for the time being, otherwise it will take more time. After all, the other three websites have no problems, so you can ignore the security problem of the server for the time being.

Second, upgrade the confident version of WP program

Instead of online updating and upgrading, all files are deleted, except the wp content folder and wp-config.php file. Here, our unknown friends can make a backup first. Manual replacement is used to replace the latest procedures of the website. Then upgrade to the latest WP program.

Third, replace the latest theme and reinstall all plug-ins

This theme is always used by him, and of course there is no latest version. Since he wants to use it, he will still use his earliest version. I originally suggested replacing the official free theme or paid theme of WP. This one goes first. However, I uninstall and delete all the plug-ins, and then reinstall several plug-ins with a large number of users. Non official plug-ins and unknown plug-ins are not installed.

Fourth, check the uploads file

Check the files in uploads and all folders. You can see that there are many PHP files and non image files in the Uploads folder. It is estimated that the files uploaded here are all checked and deleted one by one.

Finally, delete the unknown administrator user and modify the password of your own administrator. At the same time, change the password of the website database. After the replacement, wait a few days to see if there is any problem.