Title: Potential hack?
Last modified: April 6, 2017

---

# Potential hack?

 *  [jgold723](https://wordpress.org/support/users/jgold723/)
 * (@jgold723)
 * [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/)
 * Something strange is happening. When I check my server files, I’m seeing a dotfile(.
   bt) which is being placed in in the first directory that appears alphabetically
   in my public_html directory. In this case it’s a directory marked “stats” but
   it’s been other directories.
 * It’s a text file and contains about 11,000+ lines, each of which appears to be
   an IP address.
 * My WordPress install is up to date, as are all plugins. I’ve changed the FTP 
   password, as well my WordPress admin password.
 * The site does not seem to be affected – -it’s just this file which keeps reappearing,
   even after I delete it.
 * Any idea what might be happening here? I’ve alerted my web host, but they seem
   stumped.
 * Thanks,
 * John

Viewing 4 replies - 1 through 4 (of 4 total)

 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/#post-9002653)
 * Take a deep breath and carefully follow [this guide](https://codex.wordpress.org/FAQ_My_site_was_hacked).
   When you’re done, you may want to implement some (if not all) of [the recommended security measures](https://codex.wordpress.org/Hardening_WordPress).
 * If you’re unable to clean your site(s) successfully, there are reputable organizations
   that can clean your sites for you. Sucuri and Wordfence are a couple.
 *  [Adame](https://wordpress.org/support/users/dahmaniadame/)
 * (@dahmaniadame)
 * [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/#post-9003614)
 * Chances are you’ve been hacked.
 * As a first step, install and activate [Wordfence](https://wordpress.org/plugins/wordfence/),
   and run a scan. They have a pretty good scanning feature.
 * If nothing is detected, you might have to check out your files manually.
 * [redacted]
 * Good luck!
    -  This reply was modified 9 years, 1 month ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/).
 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/#post-9003635)
 * [@adame](https://wordpress.org/support/users/adame/): a friendly, off-topic note
   regarding your posts that include a link back to your site. It’s pushing the 
   forum rules, because at the bottom of the post, you are selling a service to 
   clean hacked sites. Please refrain from such links on future posts. Thanks.
 * [https://make.wordpress.org/support/handbook/forum-welcome/#do-not-advertise-or-promote-products](https://make.wordpress.org/support/handbook/forum-welcome/#do-not-advertise-or-promote-products)
   and [https://make.wordpress.org/support/handbook/forum-welcome/#avoid-signatures](https://make.wordpress.org/support/handbook/forum-welcome/#avoid-signatures)
    -  This reply was modified 9 years, 1 month ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/).
 *  [Adame](https://wordpress.org/support/users/dahmaniadame/)
 * (@dahmaniadame)
 * [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/#post-9003652)
 * [@sterndata](https://wordpress.org/support/users/sterndata/): wasn’t my intention
   to fish in your pool 🙂 But I got it, no more link to my pages.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Potential hack?’ is closed to new replies.

## Tags

 * [bt](https://wordpress.org/support/topic-tag/bt/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 4 replies
 * 3 participants
 * Last reply from: [Adame](https://wordpress.org/support/users/dahmaniadame/)
 * Last activity: [9 years, 1 month ago](https://wordpress.org/support/topic/potential-hack/#post-9003652)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics