Can someone help review our WP visitor logs for possible internal hack?

Posted May 16, 2017 1.6k views

My business has been using an outside developer who has complete access to our site. Lately we have noticed many business anomalies that just don’t make sense and we are starting to suspect our developer may be managing a redirect within our server. We lack the technical skills to know what to look for and a review of our server visitor logs just makes us more confused and suspect. For instance our visitor log shows many random “xmlrpc.php” entries, but not sure if they are normal or not.
We have been unable to locate any service or individual to assist us, so I’m hoping maybe someone in this community can make a suggestion, or possibly help by reviewing our logs and setup. I really hope we are not imposing, but we’re at our wits end.
Thank you!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
3 answers


Would you be able to post the output of the following command?

tail -50 /var/log/apache2/error.log

That’ll, at the very least, allow us to see some of what’s being logged, including the xmlrpc if the hit is logged to the error log.

If you’d prefer to communicate privately, my e-mail is in my profile and we can discuss from there. I’ve worked with WordPress for quite some time and I am a sysadmin – I’ve also worked with a number of DigitalOcean customers from server setup to security and everything in between.

I’m sorry, I’m not that familiar with different commands and am unsure what that is above, or where to retrieve it. I have access to our cpanel, but I would need direction to where start.
I really appreciate your help!

  • @crimdar

    That command would need to be ran from the CLI (Command Line Interface) once logged in via Terminal, PuTTy, or another terminal-like emulator.

    If you don’t have shell or SSH access on the account, you won’t be able to run the command. You’d instead need to check your error logs manually – the location of those logs depends on how the server or account was setup.

    If you’re on a server using cPanel (a control panel), the error log is generally in the web root (i.e where your main index.php file is) unless the location has been changed.

    If you suspect a hack, whether internal or external, SSH is going to come in handy as it’s going to make things go much faster than if you have to manually search and sift through files.

Hi. I’m actually going to try you on your email. Thank you !