I just noticed that bots have been taking over my Drupal website for quite a few weeks. There are over 600 pages of content. I only noticed now because the website is on hold (still available online) at the moment. I just got a message from the hosting company that the maximum disk space has been reached, which came as a total surprise.
I've tried changing password but it's still uploading. I deleted the Basic page content type because all the content was created with that content type, but now they are using a different content type, and the content is still there even though I thought it would remove all the content when I removed basic page.
How can I stop them from creating content?
Only admins and they're creating content in my name
then you got hacked. Your Drupal site got hacked. Now what?