Drupal Answers is a question and answer site for Drupal developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since long time I have been noticing some weird activity going on on my website.

For example:

  • The includes folder was deleted
  • CSS files were modified
  • Node edit access was given to anonymous users

I was thinking it could be human error by my team, but I can confirm they are not doing anything as such because they are just updating the content without touching the site configuration.

I see these users which we never created:

  • martinm14vxbyycdniot/fallsatj@hotmail.com
  • qhzcedrichjergsj/obscenehail72mbb@seznam.cz

They show as blocked users and I don't see any content created by them. I searched for the email ids and found they are marked as spammers but dont know what it is. These things are really worrying me. Does anyone know what might be going on?

Is my website hacked?


few minutes after posting this (and after deleting above users) this user is crated

  • qhzcedrichjergsj/obscenehail72mbb@seznam.cz
share|improve this question
If you use a version control system like git you can track changes to your code more closely. – David Meister Feb 19 '14 at 10:13
up vote 4 down vote accepted

If your site is set up to allow people to register for the site, but requires administrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. That may explain why these blocked accounts exist. If this is the case, then this is normal, and no grounds for concern.

To make sure only admins can create accounts, navigate to Home » Administration » Configuration » People » Account Settings and tick the radio button "Administrators only" for "Who can register accounts?".

As for the other "weird" stuff you've noticed (includes folder deleted, CSS files modified, node edit access given to anonymous users): It gives grounds for concern, but it is impossible to tell whether it is caused by malicious actions from outsiders, or human error by some careless admin.

If node edit access were given to anonymous users, but no node was ever defaced or otherwise maliciously altered because of this, I would lean in the direction of human error.

share|improve this answer
thanks for that users tip. I think thats what was driving force to think in hacking direction – Dudepal Feb 19 '14 at 8:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.