Cloudron Forum

really, no

yes, but that is precisely what I want to avoid....,
I want to find the solution, not only to learn how to close open doors, but also because of time and pride....,

I am checking the database, as the problem is very likely to come from there,

Can you think of anything else?

because it seems strange to me that there is no powerful software to analyse back doors.

Hi @martinkbs

9 may 00:27mins
index.php
/7b1a5/

@include ("/app/data/public/wp-includes/blocks/post-featured-image/.8ae050b9.mo");

/7b1a5/

wp-config
/1ce2a/

@include ("/app/data/public/wp-includes/blocks/post-featured-image/.8ae050b9.mo");

/1ce2a/

Do all plugins and themes come from "trusted" developers or sites? Yes, the problem here can be the 1st step: cloning site from AIOWPM, here possibly there are altered permission files and folders.....?....
Remove and reinstall all plugins and themes from the installation (including all inactive ones). Done....
Remove all files that have been added and do not belong to the original development. Done....
Check the DB to rule out any SQL injection of malicious code that will cause it to re-hack the site. How?
Change all admin user passwords. Done
Disable login by username and force login by email and password only. How?

@marcusquinn i already have it....., gotmls/
wordfence....,
etc.....,

but i want get the roots of this problem........, it's only this site

Hi

1 - i did a migration with AIOWP Migration
2 - i have a backdoor, for example they edit index.php
/7b1a5/

@include ("/app/data/public/wp-includes/assets/.1d254507.mo");

/7b1a5/
3 - they can create folders and edit certain files like index.php or settings or config

i dont know what to do, support derives me here
every 4 / 7 days im hacked.......

Thank you very much

the site is hotelmardeplata.com

@girish ok, understood

I have several domains on cloudflare pointing to the ip of my old server,

To which ip do I have to redirect each app I have?

for example new1.myserver.com to cloudtron base ip?
new2.myserver.com to where do I point it?

I have not understood this very well

I mean, how do I point several domains to an ip and only the site is seen, without damaging the parent site?
Thanks