More than half of my sites were hacked!

Jenny. This is generally due to a poor password. Creating the MOST cryptic password you can help. Never use an actual word, from anywhere, ever. I had a few sites hacked once and after having to delete one completely i started using some crazy passwords and change them fairly often. That stopped the hacks. I also keep my WP as current as possible.

Also, there are a couple of good backup plugins that backup content and not code.

Cheers
miles

That really sucks. I just use the random passwords given to me by Wordpress. I figure it's a good idea as they're so random, but perhaps I should go through and change them all to random passwords, again.

Wordpress hack again!

Why does anyone use it?

It can also be because your computer has a virus or keystroke logger on it...

That infection can capture your login info for your WP sites and send it of to who knows where - the malicious underworld then logs in with your credentials and you're having a bad day.

Other threads abound on this. Check for a strong password on your WP installs. Do complete scans on your computer(s) for viruses and malware.

free.avg.com if you don't have an antivirus program
Malwarebytes if you don't have a spyware program

Sorry you are in the boat you are in - it's not fun. That said, moving forward, please always make sure you have a current backup of your sites somewhere besides your web host. Even if they back them up for you (some do, some don't) it's a good idea to export everything and keep it at your office/home so it's away from the server location.

Best of luck.

Strong passwords = yes, but its not the answer to all of your problems.

Is your home computer secure? Do you install security updates? Do you scan for mal-ware? Do you have an anti-virus on your home computer?

Do you log into your sites from anywhere besides your home computer?

It does not do any good to have a strong password, if you have a keystroke logger installed on your computer. Regardless of what you change the password to, the program will get it again, and email it to the hacker.

Do you have brute force protection installed on the server? So that after 5 attempts to log in, your account is locked down.

Is this a shared server? Another site on the server could have been compromised, and the hacker could have used an exploit to elevate permissions to root or power user.

Is all of the server up-to-date on security patches? Is apache, mysql, php,,,, up to date?

Does your host have a reputation of weak security?

Are you using a database driven content management system? If so, is it up-to-date?

Are you on a shared network, like a college campus - where someone can use a packet sniffer to grab your ftp or root user name and password? A lot of programs use clear text to transmit usernames and passwords. When all possible, use SFTP - so the log in information is encrypted.

Yep, keyloggers are I would say the main source. Right after that are shared exploits from compromised accounts with shared hosting. Backup and check your sites frequently.

TomG.

I can totally sympathize with you, this happed to me a few months ago and left everything in a complete mess, the hacker had inserted a script that spammed articles onto my pages, it took me ages to fix.

This hack was caused by a security hole with some web hosts, not WordPress. GoDaddy in particular was hit hard with this one a few months back.

The worm worked its way through php files on the sever. Because WordPress is coded in php it was affected.

Be sure to check all your plugin and theme files as well as your core WordPress files because they may have been infected as well.

I know someone who is trying to move to static HTML after having a bad experience with his wordpress site hosted with Mediatemple