A client’s WordPress site was not working  properly – it only showed the front page – whatever page i clicked on.

Though some pages licked to a chinese website.

The site had Wordfence and Limited Login attempt plugins set up but still this had happened. The client had not kept everything  up to date though.

AS i host with 20i i was able to do a timeline backup and restore the site of a few days ago – before the malware broke the site.

Then i uninstalled Wordfence and reinstalled it. It then did a search of the site and found that Classic Editor had been hacked.

Which was odd as Classic Editor plugin was not listed in the plugins.

I then FTP’d into the sit eand saw tha there was indeed a Classic Editor plugin folder. I downloaded and opened classic-editor.php.

This had lots of line of code and a long function string instead of the proper Classis editor code:

I deleted the folder and installed Classic Editor – i note that its not been updated for 4 months

Anyway i will keep an eye on this