Title: Fix Missing Email Accounts in cPanel After a WordPress Hack  
PrimaryCategory: cPanel &amp; WHM Hosting  
Type: Informational  
Tags: email_accounts, cpanel, wordpress_hack, shadow_file, security, restoration  
Source UI Terms: None  
Source Reference: Fix Missing Email Accounts in cPanel After a WordPress Hack  

Key Info:  
When email accounts disappear from cPanel after a site compromise, it may be due to a WordPress hack. This occurs because the email account entries go missing from the shadow file used by cPanel. Often, hackers exploit vulnerabilities in outdated WordPress applications by uploading malicious scripts.

A common symptom of this hack is the presence of backup files named `shadow.roottn.bak` inside the directory `/home//etc/`. The hacker’s script renames the original `shadow` file to `shadow.roottn.bak` and creates a new, possibly altered shadow file, which removes or changes email account entries.

The malicious script files typically found within the WordPress installation folder are named `wp-crop.php` and `wp-crops.php`.  

Resolution involves removing or disabling these hacked files and restoring the original email account entries using the `shadow.roottn.bak` file. It is also important to instruct the customer to change their cPanel and WordPress passwords and to upgrade WordPress and its themes to the latest versions to prevent recurrence.

Summary:  
WordPress hacks can cause email accounts to disappear from cPanel by modifying the shadow file; restoring from the backup shadow file and securing account credentials resolves the issue.

Evaluation Pairs:  
Q: Why are my email accounts missing from cPanel after my WordPress site was hacked?  
A: The hacker renamed the shadow file to `shadow.roottn.bak` and created a new shadow file that omits your email accounts, causing them to disappear from cPanel.  

Q: How can I restore missing email accounts caused by a WordPress hack?  
A: Remove or disable the malicious files `wp-crop.php` and `wp-crops.php`, then restore the email accounts by using the `shadow.roottn.bak` backup file in `/home//etc/`.  

Q: What should I do after restoring my email accounts to protect my site?  
A: Change your cPanel and WordPress passwords and update WordPress, including its themes, to the latest versions.

When email accounts disappear after a site compromise. This article explains how WordPress hacks can affect cPanel email accounts. 
 
Issue: Email accounts missing from cPanel Reason:The emails accounts get disappeared from cPanel due to the email account entry missing in the shadow file. In such cases, please check if there is any backup file named &#39;shadow.roottn.bak&#39; inside /home/&lt;user&gt;/etc/&lt;domain_name&gt;. If yes, then it is a case of wordpress hacking where the hacker uploads a script inside the account by exploiting the vulnerability of outdated wordpress application. The script will rename the shadow file to shadow.roottn.bak and creates a new shadow file (possibly with different password) . The hacked file name will be wp-crop.php and wp-crops.php inside the wordpress installation folder. Resolution: If you found any such instance, disable or remove such hacked files and restore the email accounts from shadow.roottn.bak file. Also update the customer to change the cPanel , wordpress password and upgrade the wordpress to latest versions along with the themes.

When email accounts disappear after a site compromise. This article explains how WordPress hacks can affect cPanel email accounts.