[ISSUE] Help, I can't access my WordPress Admin

[danger]

Hello everyone, I can't access my WordPress admin anymore. When I go to /wp-admin or /wp-login.php, I am redirected to the home page of my site. I did a scan with sucuri and he tells me this: Known Spam detected: spam-seo?japanese.0

Can someone help me get my site back? Thank you in advance!

 

[gg786]

do you have access to cpanel ?

so you can edit the config .PHP according to your site name URLs and database name password etc.

 

[gg786]

or install wp fence for the scanning the site it will be helpful.

 

[danger]

or install wp fence for the scanning the site it will be helpful.

I can't access my admin dashboard, I'm redirected to the index of my site every time :/

 

[biscuit]

Whats your URL? I can check the source for you.

 

[danger]

Whats your URL? I can check the source for you.

www.comineswarneton.com

 

[SunnyDance]

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

 

[biscuit]

Try to FTP and rename the plugins folder. See if it gets fixed.

 

[sandybandy]

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

Check your .htaccess file in root
also check all hidden files wp root
seems like you have used a malware plugin or theme

 

[danger]

Try to FTP and rename the plugins folder. See if it gets fixed.

Already did but that's not that

 

[danger]

Check your .htaccess file in root
also check all hidden files wp root
seems like you have used a malware plugin or theme

The .htaccess is the problem I think because it has 444 permission.

 

[SunnyDance]

Your_Site/wp-admin seems to be permanatly redirected by some spam code.

GET
scheme
https host
comineswarneton.com
filename /wp-admin/
Address 35.214.157.226:443
Status301 Moved Permanently

Thru - Cpanel
Check the Robots.txt and .htaccess files see if there are any changes.

 

[danger]

Go to Cpanel >>> wp-config.php >>> Change wp_debug=True.
Also check Your_Site_Folder>> error_log

Check the error messages. If possible paste the most recent eroor Log here

I have this : [12-Jan-2021 08:42:49 UTC] PHP Notice: Undefined variable: url in /home/customer/www/comineswarneton.com/public_html/wp-includes/version.php on line 1

 

[danger]

Your_Site/wp-admin seems to be permanatly redirected by some spam code.

GET
scheme
https host
comineswarneton.com
filename /wp-admin/
Address 35.214.157.226:443
Status301 Moved Permanently

Thru - Cpanel
Check the Robots.txt and .htaccess files see if there are any changes.

Here is my htaccess :
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^content-([^/]+) index.php?content=$1
RewriteRule ^sitemap-([^/]+).xml$ index.php?sitemap=$1 [L]
RewriteRule ^wp-phpinfo\.php$ wp-phpinfo.php [L]
RewriteRule ^wp-config-sample\.php$ wp-config-sample.php [L]
RewriteRule ^.*\.php\??.* index.php [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

 

[danger]

I can't change the File Permission of htaccess

 

[SunnyDance]

Check your wp-content/uploads directory for files with blacklisted extensions, like .php, .js and .ico. If you find such files, check the content for characters like base64_decode, rot13, eval, strrev, gzinflate, etc.

 

[gireesh]

1. Simply go do
2. ur cPanel
3. go to WordPress Installation
4. find your domain name from list
5. click Login

Or You can

Locate the WordPress installation directory , rename the security plugin "_bkp"

 

[SunnyDance]

Refer to this - https://betterstudio.com/blog/cant-login-to-wordpress-admin/

 

[danger]

Ok so I have made a scan, and this appear :

[STR]obfuscated_php_code_3 [12/01/21] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/index.php

[HEX]gen_php_obfusc3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-config-sample.php

[STR]obfuscated_php_code_3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-includes/index.txt

Can I delete all these files ?

 

[sandybandy]

Ok so I have made a scan, and this appear :

[STR]obfuscated_php_code_3 [12/01/21] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/index.php

[HEX]gen_php_obfusc3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-config-sample.php

[STR]obfuscated_php_code_3 [20/11/20] /home/u421-8t56csj338ht/www/comineswarneton.com/public_html/wp-includes/index.txt

Can I delete all these files ?

no, check the unknown codes inside these files which are forwarding especially javascript code and these codes are usually placed at the last.