After the hack

Yeah, I got hacked.

With a stable internet connection ready to do it was finally time to clear through the aftermath of the hack. For years I have run a small number of sites for myself, friends, community interest groups and some local businesses. My go to platform has been WordPress. It used to be everywhere before the internet was reconsolidated to the major platform providers. It is easy to set up, you can install the database and files yourself and away you go.

To say my content is niche niche is something of an understatement. My quiet little corner of the internet wandered along with ones and sometimes tens of visitors, many of whom I knew personally, without any trouble at all.

This change in 2024 when what appears to be an automated worm infected my site and quickly worked its way through all of my sites, gaining access to my hosting and FTP credentials and subverting my access and sites. This is where I could go on to tell you what happened, who did it, why they did it, but the simple truth is I don’t know the answers to those questions.

Spotting the problem was difficult enough. Files change all the time as a consequence of automated actions or changes made by the hosting provider. Yet I could see files being created with unknown functions, php scripts being placed in random locations where they could never be found or executed, random files showing up in my public directories.

Then the sites went down, I lost the ability to sign in, pages were replaced with mumbo jumbo articles filled with links to other sites. Suddenly it was absundantly clear I was no longer in control.
So I tried to fix it. I deleted files, edited key files to remove the malicious lines of code, only to watch more files spring up, more instances of these suspicious scripts appearing and sometimes within minutes the sites I tried to seize control of would return to their corrupted version. I was beat.

Getting back to business

So, this week, with the aid of my internet connection and some input from others with similar experiences, and from Claude, I worked my way through my hosting account, changing all of the passwords, deleting old credentials and clearing house. I backed up all of the sites and then cleared them from the account, removing the databases and files associated with them until the hosting account was essentially empty.

The big reboot is underway.

I bought a series of themes from a website called ThemeForest. In readiness I went and ran through the ones which were still available, as sometimes the people who make them take them down. I would say one in five were gone, little stickers over my receipts explaining I was no longer able to download the files I had paid for. I’m not sure I am too worried about that. The internet moves quickly and a theme which worked well and looked good a few years ago may not do either of those things today.

Besides, I had gone for clever themes with all sort of features, sometimes stretching into the hundred of mb and often requiring a series of supporting plugins and tool sets to use properly. While I grabbed all of the files I am not sure that’s the way I am going to go this time. Perhaps it makes a little more sense to focus on serving the content simply and quickly?

I have already decided I won’t be selling the data I will inevitably collect nor will I be allowing anyone else to post ads on the site. Best to keep it simple and let those who would like to read my stuff read it, and those who don’t can, well, not.