Attempted hack

[travelin cat]

Yesterday someone tried to get into a clients Wordpress install using my username, Better WP Security blocked them but they somehow had my username which I NEVER give to anyone. This particular one was 12 characters long with numerals, capital letters and lowercase letters. They got the info correct, but the last two letters were lowercase instead of uppercase.

The IP said they were in South Korea. Any idea how this could happen?

[mrblond]

Scary stuff.

I use the Login Page Rename plugin, so they'd need to know the name of /wp-login.php to get there.

These hackers are unbelievably amazing sometimes.

[lorax]

Likely via another site on the same server but just in case - any outdated plugins or themes on the site?

[travelin cat]

Nope. Everything is up to date.

[lorax]

The most likely reason is if code is out of date (how old is the theme and how much customization was done?). Other than this, if your plugins & core are up to date, then they came in another way. Not through WordPress.

[travelin cat]

The theme is new and updated regularly. I made a child theme that has a lot of css customizing, but nothing else.

[lorax]

Another thought. Did you access the site from a public WiFi at any point in the past month or so?

[travelin cat]

Nope. I never use public wifi.

[lorax]

How strong is your salt?

Passwords are hashed before being put into the database so I strongly suspect someone either had access to your passwords or got to your database through another route.

Does your client access the site via FTP? Have they given access to anyone else for any reason? Do the site have any plugins from new or sketchy authors?

[smallcompany]

Any idea how this could happen?

It happened to me in the past that my "hand picked" admin user name was used like in your case.
It turned that the picture gallery plugin would make my user name available whenever I would upload a photo into the gallery. The user name itself would not be published to be seen via a browser online, but it would be available within the HTML code.

I figured it by searching the database for the user name to see where it was actually showing up. That helped.

[travelin cat]

Lorax, I'm the only one that has FTP access and the plugins are all tried and true ones like Yoast SEO and Better WP Security (which blocked the attack).

smallcompany, there is no gallery, but I will go through all of the page's source code to see if I can find something.

[travelin cat]

I found it! This was in the initial post's source code I made for the client: <p class="meta-info"> By <a href="http://example.com/author/username/" title="Posts by company name" rel="author">

Any idea how to remove the meta info?

[travelin cat]

My theme had a setting to remove the author data, so now it's gone. Phew. What a pain in the butt.

[lorax]

Glad you got it sorted!