Uninvited person has 'accepted' a nonexistent invitation to a private blog site

• 

  rsroos · Member · Mar 29, 2018 at 10:32 am

  • Copy link
  • Add topic to favorites

  I received an email this morning saying that someone ‘accepted’ an invitation to join a blog that I administer. This is a private family blog with no public access. I immediately changed my password, and I checked the user list–nobody new had been added and nothing appeared out of order. The blog has been inactive for about a year. Do I need to do any more? (The email headers appear to be legit.)

  The blog I need help with is: (visible only to logged in users)

• 

  baldfreud · Member · Mar 29, 2018 at 10:36 am

  • Copy link

  Hi,

  if you are concerned about your someone else accessing your site you can add the tag, “modlook”, to this post. Someone from Staff will help you with that as soon as they become available.

  https://en.support.wordpress.com/getting-help-in-the-forums/#how-do-i-get-a-moderatorstaff-reply-for-my-question

  You can also activate a Two-Step Authenticator for extra security for your account.

  Enable Two-Step Authentication

• 

  rsroos · Member · Mar 29, 2018 at 11:26 am

  • Copy link

  I just noticed that in the list of “Viewers” of my blog it shows the person who supposedly “accepted” an invitation. I don’t know how a non-member of the blog could have viewed it. (I can provide that information if you need it, as well as the original email.)

  I’m going to ask the other members to change their passwords as well.

  Thanks to baldfreud for the prompt initial response to this question.

• 

  rsroos · Member · Mar 29, 2018 at 11:42 am

  • Copy link

  Oh, one more thing–should I “remove” the unwanted viewer from the “Viewers” page, or leave it there until someone can inspect the site?

• 

  fstat · Staff · Mar 29, 2018 at 11:57 am

  • Copy link

  Hi there,

  It looks like it was your account that sent out the invite along with three other invites. So, it’s a good thing that you’ve changed your password.

  Please remove the follower and the pending invitations by selecting the Invites tab.

  If you have any other questions, just let me know and I’ll be happy to help.

• 

  justjennifer · Member · Mar 29, 2018 at 12:08 pm

  • Copy link

  One other thing I’d like to mention on security besides @baldfreud’s excellent suggestion to enable 2-step authentication is to always log out of your account at the end of a session. You can find more security tips in our support guide here: https://en.support.wordpress.com/security/#keep-your-secrets-secret

• 

  rsroos · Member · Mar 29, 2018 at 12:19 pm

  • Copy link

  Thanks. I’ll enable the 2-step authentication and always log out!