I’ve had two WordPress sites for years. They’ve also been dormant for years which means they don’t get updated as often as they should. This Resulted in both of them being hacked about the same time in the same way I think. I don’t know how they hacked the sites but both were full of posts about writing essays for money. I quickly rebuilt both websites within an hour because I didn’t care about the way it looks so both have new themes.
1. Install WordPress exporter and export all your real posts and pages. You might be able to do this by date or category.
2. Move the old website folder into it’s own and disable database access
3. Create a blank database and new database user
4. Install a brand new wordpress and import the posts and pages. Use a different password for your admin accounts.
5. Setup the menu and check the posts out.
6. Tweet the theme so suit you
7. Remove any themes and plugins you don’t use.
When you export the posts you may want to check them in a text editor before importing them into your fresh wordpress. I didn’t and discovered that Javascript had been put into all my posts. It was the same in each post so I removed this in one go by doing a find and replace in the database.
The lesson I’ve learnt it to make sure you keep your wordpress website up to date because these bloody things are fragile. I fixed a permission issue which means I can install updates from the admin instead of via SFTP. I also edited wp-login.php so it will only allow my IP address since I’m the only one that uses it.
The main reason I still have this website up and running is because most of the posts I have were written because at the time I couldn’t find the answer online. So I wrote the answer I came up with with the hope it will help someone else save hours figuring something out. I’m tempted to convert this over to a static website with Jeykll so I don’t have to worry about it.