Security Oct 18, 2026
Your WordPress site got hacked. Changing the password will not lock them out.A hacked WordPress site is not fixed when you change the admin password. On a site I cleaned up, the attacker had planted three Application Passwords that survive a reset. Here is how I investigated it, file by file and table by table, what I rebuilt, and a 10-minute check you can run on your own site.
Read article