Over the last day or so, I noticed that any posts added to Ralford.net as a “Link” were not appearing. Instead, they were displaying as an upload box next to a submit button. I ignored the issue for a day or two, and today noticed that the same was true of all old “Link” posts.
Upon reviewing the files on my web host, I noticed that a number of malicious files and folders had been added over the last few days — I had been hacked!
I have been backing up my site every Sunday using the XCloner plugin since May of 2013 and a cron job. In under 10 minutes, I was able to replace my entire WordPress folder with this past Sunday’s XCloner back-up, restoring my site to the last known good state. Though I did an export from WordPress prior to restoring, to my surprise, no posts added since the back-up were lost. And all “Link” posts are all back to normal. (Though I failed to save a few uploaded photos before restoring — but I have back-ups of those elsewhere.)