Hacked: Why I’m kicking out WordPress
It started with an email like this on my screen: Your password has been changed.
Well, definitely not. I hadn’t changed anything at all.
Some hacker or other had found an old vulnerability in WordPress and was right inside the backend of the Ronald Thump Parody website. Within a few minutes, my password had been changed, strange accounts appeared in the database, a signature page was hanging on the site, and the AI had been modified. That is, the hacker had dived straight into the system prompt.
AI hijacked… but the hacker was right
Usually, with a hack like this, you only get junk or vague advertisements. This was different.
The hacker had rewritten the instructions for the interactive Ronald Thump avatar. Suddenly, it said that the clone had to shout that climate change is a hoax.
I feel very differently about that myself, but when I read that modified prompt, I couldn’t deny one thing: that hacker had actually portrayed that character a lot better than I did. So when I went to fix things, I just left that text there. With a parody, it’s about the character being right, even if I don’t agree with it myself. It is funny, though, that such a suggestion comes in via a hack.
Laziness costs you your head
I actually used WordPress simply because it’s easy. A CMS for lazy people, simple enough. But that is precisely the problem. Everyone knows that code, so intruders run scans day and night to see where the door is ajar.
One outdated version was enough. Through an SQL injection, the tables were exposed in no time, and I lost control.
Run everything out and rebuilt it myself
I didn’t feel like patching things up a bit. The real solution was simple: throw out the weakest link. And that was WordPress itself.
I immediately rebuilt the site completely from scratch as a standalone website, directly around the avatar:
- No more CMS junk: No unnecessary layers that hackers can exploit.
- Direct AI connection: It now runs smoothly on the functionality itself, without all that complicated stuff surrounding it.
- Custom engine: It runs on the Avatar Talker that I built together with AI. By the way, you can download that for free from GitHub if you want to get started with AI cloning yourself.
The new site is already online. I just need to fix a few last things on mobile, but it is running.
My lesson
Just don’t use WordPress. It’s handy if you’re lazy, but it simply isn’t secure. If you leave it lying around for even a moment, you’re screwed. Do you want something that is secure and runs smoothly? Rip out those extra layers and just build it yourself.