HI there Adam - could I ask a further question about this... I like the QR code idea, but surely what's actually needed is a way to add a QR code to the Order Status page? If it's added to the Event page as you suggest, then it's going to be available for anyone whether they've bought a ticket or not? One alternative idea would be to take the QR code generated, and then make a PDF with it printed on it, and add that as the ticket download link. It would at least be linked to the event, but of course would not have dynamic customer information associated with it (I think The Events Calendar allows you do to this, by the way.)

Thanks for checking - it would be good to find out how it can be fixed. Don't worry about fixing the current fault - I can more easily recreate the blog entries than worrying now about restoring. But it would be good to know I can rely on Snapshot backups in future. Thanks Giles

But of course finding wp-config file becomes a slightly harder job if you have disabled the editor... Would be good if Defender had an option to turn it on and off, so long as that didn't reopen the vulnerability which it closed in the first place....

Hmmm. Ok, maybe you've got a point Jerone.. Maybe this could be part of the strategy to reach them... You say What if you regenerated their passwords...

Thanks for this advice. I tried all of these but whatever I did the hacked pages remained. In the end I paid for the site to be deep cleaned - it cost a bit but I feel much better knowing that there aren't hundreds of dodgy pages linked to my site.

Thanks for your thoughts fellas. It's a puzzler. But I think I'm going to do it (ie delete them). The reason is that it's so long (at least 18 months)...

Adam yes that sounds like a good idea, please do move it! Best wishes Giles ...

Thanks Ash but I've now got it sorted. I got a guy from WPfixit to sort it out - it took him a while to find the offending code but he did it in the end. The answer, for anyone who has this problem in the future and can't solve it, is that there was a www version of the website stored in the wp_k0xvyr_site table (you can see these if you go via phpmyadmin).

Hi there - I'm having exactly the same problem - did Luis's suggestion fix things? I've tried it but it still leads to the page not loading because of too many redirects - you can see the page trying to load domain.com then www.domain.com, then back to domain.com, again and again. Removing the code at least means the pages load, albeit redirecting to that blessed /wp-signup.php?new= page.