[ISSUE] Help, I can't access my WordPress Admin

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #1

Hello everyone, I can't access my WordPress admin anymore. When I go to /wp-admin or /wp-login.php, I am redirected to the home page of my site. I did a scan with sucuri and he tells me this: Known Spam detected: spam-seo?japanese.0

Can someone help me get my site back? Thank you in advance!

 

G

gg786

Active member

Jun 2, 2020

197

28

28

• Jan 12, 2021

• #2

do you have access to cpanel ?

so you can edit the config .PHP according to your site name URLs and database name password etc.

 

G

gg786

Active member

Jun 2, 2020

197

28

28

• Jan 12, 2021

• #3

or install wp fence for the scanning the site it will be helpful.

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #4

gg786 said:

or install wp fence for the scanning the site it will be helpful.

Click to expand...

I can't access my admin dashboard, I'm redirected to the index of my site every time :/

 

biscuit

Well-known member

May 30, 2018

417

240

63

• Jan 12, 2021

• #5

Whats your URL? I can check the source for you.

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #6

gopo said:

Whats your URL? I can check the source for you.

Click to expand...

www.comineswarneton.com

 

SunnyDance

Member

Aug 13, 2020

40

14

8

• Jan 12, 2021

• #7

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

 

biscuit

Well-known member

May 30, 2018

417

240

63

• Jan 12, 2021

• #8

Try to FTP and rename the plugins folder. See if it gets fixed.

 

sandybandy

Well-known member

Trusted Uploader

Nov 19, 2019

317

627

93

4th Dimension

babiato.tech

• Jan 12, 2021

• #9

SunnyDance said:

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

Click to expand...

Check your .htaccess file in root
also check all hidden files wp root
seems like you have used a malware plugin or theme

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #10

gopo said:

Try to FTP and rename the plugins folder. See if it gets fixed.

Click to expand...

Already did but that's not that

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #11

sandybandy said:

Check your .htaccess file in root
also check all hidden files wp root
seems like you have used a malware plugin or theme

Click to expand...

The .htaccess is the problem I think because it has 444 permission.

 

SunnyDance

Member

Aug 13, 2020

40

14

8

• Jan 12, 2021

• #12

Your_Site/wp-admin seems to be permanatly redirected by some spam code.

GET
scheme
https host
comineswarneton.com
filename /wp-admin/
Address 35.214.157.226:443
Status301 Moved Permanently

Thru - Cpanel
Check the Robots.txt and .htaccess files see if there are any changes.

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #13

SunnyDance said:

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

Click to expand...

I have this : [12-Jan-2021 08:42:49 UTC] PHP Notice: Undefined variable: url in /home/customer/www/comineswarneton.com/public_html/wp-includes/version.php on line 1

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #14

SunnyDance said:

Your_Site/wp-admin seems to be permanatly redirected by some spam code.

GET
scheme
https host
comineswarneton.com
filename /wp-admin/
Address 35.214.157.226:443
Status301 Moved Permanently

Thru - Cpanel
Check the Robots.txt and .htaccess files see if there are any changes.

Click to expand...

Here is my htaccess :
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^content-([^/]+) index.php?content=$1
RewriteRule ^sitemap-([^/]+).xml$ index.php?sitemap=$1 [L]
RewriteRule ^wp-phpinfo\.php$ wp-phpinfo.php [L]
RewriteRule ^wp-config-sample\.php$ wp-config-sample.php [L]
RewriteRule ^.*\.php\??.* index.php [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #15

I can't change the File Permission of htaccess

 

SunnyDance

Member

Aug 13, 2020

40

14

8

• Jan 12, 2021

• #16

Check your wp-content/uploads directory for files with blacklisted extensions, like .php, .js and .ico. If you find such files, check the content for characters like base64_decode, rot13, eval, strrev, gzinflate, etc.

 

gireesh

Active member

Banned User

Jul 26, 2020

135

62

28

• Jan 12, 2021

• #17

1. Simply go do
2. ur cPanel
3. go to WordPress Installation
4. find your domain name from list
5. click Login

Or You can

Locate the WordPress installation directory , rename the security plugin "_bkp"

 

SunnyDance

Member

Aug 13, 2020

40

14

8

• Jan 12, 2021

• #18

Refer to this - https://betterstudio.com/blog/cant-login-to-wordpress-admin/

 

danger

Member

Jan 6, 2019

121

23

18

Belgique

• Jan 12, 2021

• #19

Ok so I have made a scan, and this appear :

[STR]obfuscated_php_code_3 [12/01/21] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/index.php

[HEX]gen_php_obfusc3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-config-sample.php

[STR]obfuscated_php_code_3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-includes/index.txt

Can I delete all these files ?

 

sandybandy

Well-known member

Trusted Uploader

Nov 19, 2019

317

627

93

4th Dimension

babiato.tech

• Jan 12, 2021

• #20

danger said:

Ok so I have made a scan, and this appear :

[STR]obfuscated_php_code_3 [12/01/21] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/index.php

[HEX]gen_php_obfusc3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-config-sample.php

[STR]obfuscated_php_code_3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-includes/index.txt

Can I delete all these files ?

Click to expand...

no, check the unknown codes inside these files which are forwarding especially javascript code and these codes are usually placed at the last.