I Got Hacked and That Made Me Move
Friday night, I was headed for bed. I brought up my RSS feeds in NewsBlur and noticed six new posts on this blog. About gambling. All six copypastas of an advertisement of some gambling site. These articles jolted me from near-sleep to wide awake, and I bolted to my home office. And I thought, “How am I even important enough to hack?”
After logging in to my hosting service, I changed my account password. Then I deleted the posts from WordPress. Note: I run my own copy of WordPress on my hosting service. And then started forensics. I found a new WordPress admin. Delete. I found a bunch of new FTP accounts. Delete. I was already at the latest WordPress version, but on an older PHP version. Upgrade. Crisis averted, maybe? I started poking around the file system, and found some suspicious files in wp-content:
.56f99430.php.user.ini36e3a060.zip56f99430.phpadvanced-cache.phpdb.phpcache/d8ce5240.php
I spun up Claude Code and started asking questions. Claude was a patient ally through the next couple of hours. At Claude’s advice, I deleted the files. Refreshed the site. And then saw that the files were back, and a new WordPress admin had been added. Ouch. At Claude’s bidding, I found another copy of .user.ini one directory up. And a file called craft-indexer-hq.php in wp-content/mu-plugins. I ran checksums and reinstalled WordPress and deleted files would come roaring back. Sleepiness came stumbling back, and I put the site in maintenance mode and went to bed. Willing myself to not fret through the night, while knowing I would, regardless.
The site stayed in maintenance mode throughout the weekend while I considered various options. Continue trying to find and fix the hack? Switch the site to a static generator, which I’ve thought about doing a few times over the past couple of years? Shut the site down entirely? After all, I hardly post, I’m not a security expert, and at 57 I’m in the twilight of my career and spend more time tired of technology than tickled by it. Technology always breaks, and its problems rarely feel like fun puzzles to solve anymore. I stayed away and stewed through Saturday and Sunday.
Monday night, after work, I settled in for a marathon session to fix WordPress, eject the hack, and restore order. I left the site in maintenance mode. I still had Claude zeroed in, and I started hunting. I ran commands like wp core download --version=$(wp core version) --force. I deleted wp-content/uploads/2026/08/36e3a060.zip, which contained the craft-indexer-hq plugin payload. I grepped the wp-includes directory and found and fixed back doors in class-walker-comment.php, class-wp-http-response.php, and default-filters.php. Each new action brought me a sense of triumph . . . until I ran a wp command and the dirty files would reappear in wp-content. I lasted two hours, then trudged to the family room and watched fountain pen reviews on YouTube.
Today, I bit the bullet and moved this blog to Hugo. I used Claude to create a reasonable theme, and then again to import a backup of the blog from July. I completely wiped the public_html directory on my hosting service to excise all the malfeasance. I should have thought to back up the images first, but I was too headstrong to think that through. Whoops. I still have some cleaning up to do, but now I have this entire site in a Git repository, with automated deployments, and I’ve cleaned out decades of cruft.
Maybe this will spur me to blog more often!