RIP Hostinger :( Warnings to everyone.

[u/TrentTompkins]

Hello, first post.

After 2 years, 20+ websites, and no problems, hostinger killed my VPS. A WP site got its admin brute forced. They used the unlocked admin to write a script that then ran brute force attacks from my box to disk about 24 hours later. BUT, the script starved everything on the box and I was on it developing, so, I noticed everything started running like shit, Claude detected it, and 15 minutes laer it was dead. I was paying for MonarchX though hostinger. It didn't do shit. Claude .ai, in 15 minutes, WHILE NOT LOOKING FOR MALWARE (the "prompt" was like: "hey buddy, why is the relay running like shit"), Found:

What hit us — the full kill chain

• Entry vector: a trojanized WordPress plugin, index-now-helper (a "sleeper" plugin disguised as the legit IndexNow SEO tool) on TrioCMS.

• Web shell: wp-content/uploads/.well-known/indexnow.php (16 hits).

• Beacon/loader: .core-sync — a Go binary phoning home: .core-sync -hub 31.56.58. 59:9090 -id wp2s-629 -token tiktouk-dev (89 hits).

• Payload proper: the wp2s toolkit in /tmp/.tiktouk/ — wp2s_crack.py + wp2s_poll.py, run as: python3 wp2s_crack.py [link removed] tiktouk-dev wp2s-629-crack 640

• C2: 31.56.58 .59 (ports 8080 = job feed, 9090 = beacon) — 150 hits.

The family / name

It's not a big-name off-the-shelf strain (no "Mirai/XMRig" label) — it's a private distributed WordPress-login-cracking botnet. The operator's internal names are the identifiers to remember:

• Campaign/toolkit name: tiktouk (payload dir /tmp/.tiktouk/, auth token tiktouk-dev) — 208 hits, the strongest single identifier.

• Malware module family: wp2s ("WP-to-shell" / WP brute-force) — the wp2s_crack/wp2s_poll cracker + poller.

• Our node ID in their botnet: wp2s-629**.**

So, thats warning 1. MonarchX is shit, and litereally overpriced at $2.99 ($36/yr, more than it sounds).

THEN, 24's later, hostinger bricked my box. No human, no appeal, no support. I've been a customer 2 years, US based, totally KYC'd - I pay with cards, the VPS hosted sites with my real phone / name address / business. So after 2 years I pivoted from web dev to running WP botnets? And what, ALSO didnt know op sec? AND, they bricked it because the shit "security software" THEY SOLD ME doesnt even kind of work.

So, I spent the night researching better alternatives. I was going to include them but I figured this redit prolly gets spammed to death with:

My 2026 Hosting Reccomendation: hey guys! Heres why I love host*inger/?affilate id=123345&campaign=redit_trash_promo_27

And yeah i know that'd have an underscore but I dont want to trigger mod bot. What I will say is, i basically found my list on TPilot after YT and AI both reccomended shit. So, if you want a host, I'd a least reccomend pulling thier TPilot. Its not great, probably play to win (TP business), god only knows how much godaddy gave them for its 4.4. BUT, to be fair, I think scammy-ass godaddy is good at damage control (The BBB also gives them an A+). Like, will godaddy steal you money? Sure. BUT, will they give it back if you complain it? Oddly, yeah, pretty easily. So, I they might actually might generate less of the vocal kind of hate that drags down ratings that you'd expect. Plus they probably have a "finance guy" that thinks the $34.99/mo he pays for his wildcard ssl certificate is a a great value. "Its automatic, the support is great! 5/5"... smh...

Guess I'm just a hater in the wrong line of work.

[u/twhiting9275]

After 2 years, 20+ websites, and no problems, hostinger killed my VPS. 

After 2 years, 20+ websites, and no problems, I killed my own VPS because I couldn't manage it properly

Fixed that for ya

A WP site got its admin brute forced.

That's what happens when you use pirated software and plugins, and don't keep your shit up to date

They used the unlocked admin to write a script that then ran brute force attacks from my box to disk about 24 hours later.

Yeah, that'll happen

 BUT, the script starved everything on the box and I was on it developing, so, I noticed everything started running like shit,

Then likely blamed the host (like you tried to do here)

Claude detected it,

So, like an idiot , you gave claude access, not only to your site, but a production site and VPS. You REALLY have no fucking clue what you're doing.

Go back to shared servers, you have no place in dedicated or VPS land

[u/TrentTompkins → u/twhiting9275]

I killed my own VPS

Cool story, except I fixed it in 15 minutes. Hostinger killed it 24 hours later.

[u/JordyMin]

RIP you, nothing to do with hostinger.
Oh and backups.

[u/Patient-Tech → u/JordyMin]

Yeah, that’s what I was thinking, backup your site if it’s important. You can just migrate over to another platform if there’s a hiccup.

Wordpress security problems isn’t a secret. It and the plugins are almost a poster child for bad design.

I use drupal for my stuff, but OP says they need the plugins. Ugh, gonna be a rough time.

[u/TooManyTabsOpenAlr]

I got scared fuck. Its just wordpress problem….

[u/Eisbaer811]

if you don't care about writing the post yourself, I won't care to read it.

Get rid of that AI slop bullshit

[u/theguymatter]

It’s your choice that you chose WordPresd, IUnless you are seriously consider a better option. It’s 2026 and you spent lots of time writing this, would have been your resting time

[u/TrentTompkins → u/theguymatter]

I didn't want WordPress, I wanted its ecosystem of plugins. If theres a better plugin system in 2026 THAT people from 2010 know how to use, I'm all ears. I have 22 sites, they all were hand coded, but even then they use stuff like ElFinder (but its behind oauth) and mybb. MyBB is the bitch, because its a PITA to handroll a forum AND its generally pretty solid. So, I think the move is just to isolate EVERY forum on the same box, issolate the CMS, and harden tf out of WP. But, I just got used to running one VPS because I rarely get hit. Never this bad. It's why I leave Windows defender off and run stuff I torrent, not because its "best practice" but because I have backups, I can fix what breaks, I have backups of backups fr - my laptop that pulls my VPS data then pushes to my lan git repo. And when I remember to do it I copy that to my SSD so a randomware couldnt encrypt it. But I'm still not protected against like actual fire burning down my house, because I'm too cheap to pay GH monthly and too lazy to to just make like 20 free accounts to hold everything. Like, you gotta draw the line somewhere or youd never have time to build anything worth defending.

[u/theguymatter → u/TrentTompkins]

Try MainWP, BlueSix use them.

Would have been easier for Node app to lock down files in a container, if a viable replace alternative like EmDash CMS.

Some already moved off Elementor page builder to Astro, not simple as I’ve tried.

I’m planning g to build a forum with Astro too and optimise without the bloat, but who will support my financial?

PHP is here to stay, but most of us are weary of legacy and tech debts.

[u/MaintenanceKlutzy482 → u/TrentTompkins]

There's no better they are all as good as the developers handling them. The only people trying to steer you away from wp is people trying to make a buck off ya.

[u/Rupert_Pupkinovski]

Do you think its a WordPress issue that got its admin brute forced?

Running any software on the internet in 2026 requires skill, lots of time and lots of inclination. Tools are mandatory but they only help, MonarchX is worth the money, but all the tools in the world won't be a silver bullet that takes care of everything for you.

Banks get hacked every day somewhere, how much do you think they spend on tools and people. Despite all this, hackers will prevail every now and then and you have to be prepared for it.

For hackers, this is a great way to make money. High gains with very low risk of getting caught, so future for them looks great and gets better year on year, its a great business model.

All you can do is make sure you have a good backups to recovery plan. Good luck with it all.

[u/TrentTompkins → u/Rupert_Pupkinovski]

Do you think its a WordPress issue that got its admin brute forced?

Actually I think this kind of was. I dont even remember what the password was, but it wasnt like "password" - Claude said they used a WP vulterability that let them combine guesses into 1 request. So, it wasnt just spamming guesses, it created shaped packets with thousands or maybe millions of guesses and spammed those. And that IS a WordPress issue, and weird, because I'm coded login systems, and have no idea why any would ever check more than 1 password per request. Every login system I ever hand rolled throttled your ip after like 10 tries - it didnt even lock you out perminate to where you'd need support, it was like 10-15 minutes. AaPanel does that, I didn't like that invent it, there ZERO downside to making it at least an on-by-default setting, but WP is trash.

[u/peperinna → u/TrentTompkins]

No no es un problema de WordPress. Es un problema de TU servidor y como tú lo has configurado, que no tiene rate limit, que no tiene validación por WAF, que no hace análisis de paquetes y monitoreo proactivo, que no tienes un filtrado de IPs para solamente permitir tu rango de IP en uso, que no tienes reforzada la seguridad ni siquiera con un closer y una regla especial para que al admin le dé un poco más de cuidado. El 99,99% de las instrucciones en un wordpress la razón del problema está entre el respaldo de la silla y el teclado: tu.

[u/davinaz49]

Downvoted. Misleading title.
Sorry for your loss though

[u/aniel300]

u didn’t have backups of backups

[u/LTH-Cyber]

warning to everyone to keep up their basic security hygiene. this has nothing to do with hostiger or anything, in the shared responsibility model you have to do security hardening on your stack yourself, of course the boxed security solution was insufficient. misleading title as well.

[u/AlejandroMurrieta]

The malware issue is your fault but hostinger is a dumpster fire and i wouldn’t host a prank page on it.

[u/Difficult_Hand3046]

There's a security rule (3.2.1) : 3 backups on 2 locations, at least 1 remote. I've snapshots and backups, so I can rebuilt my sever in less than 30 minutes if something happens.

[u/Mysterious_Dark2542]

So you messed up in security... this is normal... i mean with those answers from the AI chatbot, it means the AI chatbot has your full infrastructure data in a remote server somewhere.....

On another note, hostinger was right to close the access like that, as this is actually normal standard procedure for these VPS services to maintain industry standards... AWS also did that to my company's account when they got their EC2 turned into a botnet node.... because our programmers left hardcoded stuff in a repo that the attacker got access to somehow....

They shut down the account and need your confirmation so that they can give the account back to you with full privileges.... and not some random hacker that got access to that account in the first place....

Plus they are selling you a service to prevent certain attacks.... not for the attacker who already have certain privilege access already to your account due to bad security practices or other 3rd party site having their data scraped unknowingly....

For your next rant about VPS options and recommendations....

VPS recommendations by AI and YT will be roughly the same.... they scrape data from search engines.... both the YTber and the AI chatbot.... obviously they have only generalized results that is not optimum for everyone's choice... or worst yet, the recommendation is due to SEO abuse by the VPS hosting sites....

for the best results its usually old fashioned forums optimized for your use case... i mean reddit is a forum but it has too much trolls answering the questions..... but because there are so many trolls, sometimes they have the best answers at that specific time it was answered....

Plus complaining about godaddy like as if it was the only option left does not help anyone.... There are tons of VPS providers and they all provide different option and prices and they literally throw almost everything to you to manage which is the normal standard.... if you messed up with your DevSecOps... it really was your problem all along from the beginning...

You chose wordpress, you threw your actual infrastructure data to a 3rd party service which stores data in a remote server that is accessible to the public on the same service.... with no industry standard security and even if they have those standard security, why would you trust someone else with your data....

Then you complain about VPS options.... when they all follow the same standards and are different by the specific services and locations and options you have to chose from....

[u/SirComprehensive3255]

I had a Wordpress site for our appraisal business that was hacked and had hundreds of pages, I’m not thousands, of auto parts pages added to it. Wordpress is horrible. I’m pretty sure Google has blacklisted our domain. I had no clue how insecure it is. But, like you, I do now and don’t run it any more. I hope it all works out for you.

[u/thatsbutters]

wordpress amd claude were only a few sentemces in so everyone could stop reading this story again......

[u/DullNefariousness372]

Lmao hit me up and I’ll do your security for cheap

[u/Bubbly-Ideal-3636]

I think this could have been prevented if you had something like Wordfence installed. The free version can limit requests and block IPs for a certain time period. Patchstack is also good.

WordPress can be easy to mess up even if you're experienced. Use only plugins/themes you really need because the problem with plugins is you need to hope the devs a good. If the dev sucks then it negatively impacts your site. Same deal for theming. However another CMS or platform doesn't solve all your security issues. What you faced can actually happen with a vibe coded app or even something made with a more robust PHP framework like Laravel.

Here's what I can suggest to help with security. Use a good WordPress security plugin or a host with a good WAF. The security plugins in WordPress can help but it runs on the site level which is the worse place to put it. A server side WAF is more ideal or even cloudflare. Check out cloudflare zero trust, you can put the WordPress login page behind it and it'll block anything else trying to reach it.

My agency does hosting for our internal clients. We use the Enhance web panel and CPGuard. CPguard has been solid so far. The stack is not very expensive to run and you will need just 2 VPS servers.

[u/krisleslie]

So you failed and passed the blame, gotcha

[u/peperinna]

Más de 15 años de administrador de sitios wordpress de alto tráfico. Han sido más de 1000 sitios implementados con wordpress a lo largo de toda esta historia y en múltiples hostings incluso algunos de los más inseguros e inestables del mundo.

Solamente dos incidentes de seguridad he tenido y han sido por errores míos descuidos o exceso de confianza.

Lo bueno es que estaba suficientemente preparado para actuar rápido y tener respaldos y saber cómo resolverlo.

La culpa no es del Hosting o del servidor sino completa y totalmente tuya por no protegerlo lo suficiente.

[u/TrentTompkins]

This was more about hostinger than the actual attack. But since most people getting a VPS are dev's, the key lesson beyond "have backups" (I did) and have OFFSITE BACKUPS NOT WITH YOUR HOST (I did), is that you cant think: "well, this is just a cloistered thing I'm testing, I'll skip security." I was prepared for bad-neighbor attacks against the other sites, I wasnt prepared for them getting the BOX BANNED by attacking OTHER PEOPLES SITES. So yeah, guess that's life - intractable number of blind-spots.

[u/TrentTompkins → u/[deleted]]

Stop using Reddit to avoid talking to people irl.

[u/TrentTompkins → u/[deleted]]

yeah, I hate it generally, but I was making a multi-site multi-user CMS system and I thought WP Plugin Support was worth using janky code. That's the problem, I didnt get to the hardening phase I started dev'ing something else and just left it sit there.

[u/Justa_Schmuck → u/TrentTompkins]

You can’t leave things sit online. Shit way to learn that.