Does WordPress.com keep backups we can restore? (site hacked, posts deleted)

  • Unknown's avatar
    heliophonstaff · Member ·

    Hello,

    On Thursday night we received an email from WordPress.com indicating that our account’s email address was changed to an unknown one. We replied the next morning (“If this request was not made by you, please respond to this email immediately”) but received no answer.

    We tried a password reset, which somehow sent the reset link to our original email, and managed to regain access to our account. Unfortunately, all of our posts were apparently permanently deleted (not in the Trash), though images are still in the gallery. We never exported the site as an XML, so we can’t import the posts back, though we do still have the content of the posts, which we could manually enter one by one should that be necessary.

    Is it possible for WordPress.com to restore our site with a backup from before Thursday?

    Thanks!

    The blog I need help with is: (visible only to logged in users)

  • Unknown's avatar
    timethief · Member ·

    If any person or any bot is posting anything to your blog or deleting content from it then you have provided them with the ability to do so either deliberately by adding them as official users, or by allowing them access to your login information, or by posting content that makes it easy for them to guess what your log-in information is.

    Who, aside from you, has access to your login information?

    Go to your email program and change the password to a very difficult one because that’s how many hackers gain access to blogs

    1. If you can log-in go here > Users > All Users and delete any user that does not belong there.

    2. Disable post by email > http://en.support.wordpress.com/post-by-email/

    3. Disable post by voice > http://en.support.wordpress.com/post-by-voice/

    4. Change your blog password to a very difficult one > http://en.support.wordpress.com/passwords/#change-your-password

    5. Use a secure, encrypted connection to connect to your Dashboard. Under Users → Personal Settings, check the box that says “Always use HTTPS when visiting administration pages, and click Save Changes.

    6. Set up two step authentication http://en.support.wordpress.com/security/two-step-authentication/

    Then read this please knowing that blogs don’t get hacked when security protocols are followed. > http://en.support.wordpress.com/security/

    P.S. I flagged this for Staff follow-up. Please subscribe to the thread so you are notified when they respond and please be patient while waiting.

    Read also http://en.support.wordpress.com/export/#backups

  • Unknown's avatar
    heliophonstaff · Member ·

    Thank you–four other people (very unlikely to be the perpetrator) had the previous login information, and the new user and password has thus far been shared with two of them. Per the link on security practices, we will better utilize user roles in the future.

    Thanks again for the help!

  • druesome · Staff ·

    Hi there! Very sorry to hear about this.

    For a blog with multiple users, sharing passwords isn’t exactly the best approach as this poses many security risks in the long run. It would be best to have members of your blog to login with their own accounts and assign them appropriate user privileges.

    http://en.support.wordpress.com/user-roles/#adding-users-to-your-site

    Is it possible for WordPress.com to restore our site with a backup from before Thursday?

    I can certainly request for a backup restore on your blog. Can you confirm that a backup from August 13, 2014 (Wednesday) would be good to work on?

    To be on the safe side, please activate two-step authentication on your account to further secure your account:

    Enable Two-Step Authentication

    Thanks!

  • Unknown's avatar
    heliophonstaff · Member ·

    Thanks so much for the help,

    Another member of our team (“A”) replied to the notification regarding the original (hacked) password change. I was unaware that a staff member (Kris) responded on Monday, and I just found out he has already worked with A to restore our blog, so it will be unnecessary to restore it again. But thank you still for your time and advice!

  • Unknown's avatar
    raincoaster · Member ·

    If you continue to share accounts and passwords, it WILL be necessary to restore it in the future, because something like this will happen again.

  • druesome · Staff ·

    @heliophonstaff: That’s good to know. Best of luck!

  • The topic ‘Does WordPress.com keep backups we can restore? (site hacked, posts deleted)’ is closed to new replies.