Today I updated a clients Wordpress site from the PDO over Sqlite wrapper. It was a good idea at the time, however Wordpress itself lacks a proper database abstraction system, so ultimately stuff broke with every update.
That said, the hype over “hacked blogs” is a bit overblown. If you’ve been keeping backups you could compare the database. But the much faster thing to do is to simply pull the user list via the MySQL command line.
mysql> select * from wp_users;
Take note of the last user names added. In this case the last username added, didn’t even have an email address. To top it off the usermeta table had marked the account as an administrator. The security model can be improved.
In the case of the client, the ID was 10. So I went:
DELETE from wp_users where ID=10;
DELETE from wp_usermeta where user_id=10;
The two larger clients sites I actually updated yesterday. You know them as marrymemovie.com and lastblood.keenspot.com . These sites actually had no “attack” on them, but rather had around 200,000 spam comment posts contributed by only 4 IP addresses. Too bad I didn’t save the list. After these spam comments were deleted, the comment tables went from 2GB down to about 80MB.
How to do this with your own Wordpress if you aren’t using something like Askimet:
select comment_author_IP, count(*) as X from wp_comments group by comment_author_IP order by X;
You’ll get a list of IP addresses that comments have been posted from. Chances are that unless your blog has been running for 10 years, one person hasn’t posted 50,000 comments. You can cross-reference the ip address with wordpress itself, use the search function on the comments to see if every comment from that IP address is spam. You can even google it, and you’ll find several blacklists.
To get rid of the most egregious spam, it’s faster to bulk delete:
delete from wp_comments where comment_author_IP=’213.163.65.163′;
delete from wp_comments where comment_author_IP like ‘194.8.7%’;
delete from wp_comments where comment_author_IP=’62.90.102.148′;
delete from wp_comments where comment_author_IP=’62.90.102.146′;
and so forth.
If you feel like cutting them off for good and save processing time on your system. Make use of the .htaccess and deny ip addresses that are a significant source of repeat spam.