How to remove phishing content from console of my wordpress website

Hello, all

The Droplet web console provides out-of-band access and is available regardless of your network settings. It emulates the access you would have if you were sitting down with a keyboard and monitor attached to the actual server. You can use this feature to log in and revert bad settings to regain normal access.

You can check our official docs for the console here:

https://www.digitalocean.com/docs/droplets/resources/console/

You will usually use the console if you can’t access your droplet using ssh via a ssh client and it’s usually the last resort option when it comes to troubleshooting.

You can also check our docs on How to Connect to Droplets with SSH:

https://www.digitalocean.com/docs/droplets/how-to/connect-with-ssh/

There are two options at the bottom of the doc: Connect with OpenSSH and Connect with PuTTY

Once you’re connected to you droplet via ssh-client you can check the recommendations provided by Bobby in the answer above.

Hope that this helps! Regards, Alex

Hello,

There are a few things that I could suggest:

• Restore to a back of your website - this would be the most straight forward solution

• If you do not have backups then I would recommend the following:

1. Install a plugin called Wordfence and run a scan with that plugin
2. Delete all plugins and themes that you are not using
3. Upload a fresh copy of your theme
4. Delete the Wordpress core files and upload new clean ones
5. Take a look at this answer here on how to secure your Wordpress website
6. If you are getting redirected to a specific phishing website, I would recommend looking for this website in your files, you could do that with the grep command:

grep -rli 'the_phishing_site.com' /var/www/your_site.com/*

Hope that this helps! Regards, Bobby