Wordpress on Samarthya

Moving to Hugo, part 2: The migration playbook

Mon, 26 Oct 2026 07:10:00 -0400

Ten phases, in the order that kept my risk low. Each one ends with something you can check, so you always know whether it’s safe to move on.

The numbers come from my own move: 137 WordPress posts from six years, a few hundred images, and a domain that also carried email. Your numbers will differ; the order shouldn’t.

Moving to Hugo, part 1: Why Hugo

Mon, 26 Oct 2026 07:00:00 -0400

After the blog was broken into, I had to decide where it would live next. This is how I made that choice, written so you can reuse the reasoning even if you end up somewhere else.

The story of the break-in is in Rebuilding samarthya.me. This series is the practical companion: why Hugo, how to migrate step by step, and what living with it is like. My own site is the worked example throughout.

Rebuilding samarthya.me, part 2: Salvaging the content

Sun, 25 Oct 2026 12:10:00 -0400

Text is easy to save. Dates, images, code blocks and six years of links are where a migration quietly loses things. Here’s what it took to bring them across.

The raw material
#

WordPress can export everything as one XML file (WXR). Together with a database dump and a copy of the uploads folder, that’s the whole site. The export held 139 published posts. Two were the attacker’s, so they were excluded permanently: 137 posts to convert.

Rebuilding samarthya.me, part 1: The day the blog fell

Sun, 25 Oct 2026 12:00:00 -0400

On 10 October 2026 my blog stopped being mine. This series is the diary of getting it back, and of moving to something simpler: from shared hosting and WordPress to a static site on GitHub Pages behind Cloudflare.

What I found
#

The site had been running WordPress on shared hosting since 2019. When things started to look wrong, a closer look turned up the classic signs of a compromise:

Salvaging six years of posts

Fri, 23 Oct 2026 20:00:00 -0400

Exported every post from the old site and went through the export carefully. The text survived. Many of the images did not: the server was serving error pages where pictures used to be. Also found a couple of “posts” I never wrote. Those stay out.

A copy of the crime scene

Thu, 22 Oct 2026 20:00:00 -0400

Took the first full copy of the old site’s database today.

It was a strange thing to read. My own account was gone. Every post, all 207 of them, belonged to the attacker’s account, the one “registered” on 10 October 1970. 46 of my posts were sitting in drafts.

The blog went down

Sat, 10 Oct 2026 21:00:00 -0400

The old WordPress blog was compromised today. Someone got in, left files behind that had no business being there, and the site stopped being something I could trust.

First moves: take it offline, change every password that touched it, and keep a copy of everything for later. Six years of posts were in there. Tomorrow’s problem is what can be saved.

The defences went off

Fri, 09 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Just after midnight (UTC), an administrator account “registered in 1970” logged in. A minute later, 20 plugins were switched off in the same second, including the one that blocks password guessing.

Casino posts under my name

Thu, 08 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

21 successful logins today, more than I’d make in a year. Early in the morning (UTC), the first spam post went up: casino and betting “reviews” in German, Spanish, Greek, Turkish, Finnish… Over the next two days there were 55 of them, published as if I’d written them.

The password worked

Wed, 07 Oct 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

Two successful logins today. The next day there would be 21.

Someone was knocking

Wed, 30 Sep 2026 20:00:00 -0400

Written on 26 October from the old site’s own records. At the time, I didn’t know any of this.

The login-protection plugin counted 165 failed logins today. Bots try passwords on every WordPress site, all year round, so a few a day is normal. This was the busiest single day in its records.

Wordpress on Samarthya

Moving to Hugo, part 2: The migration playbook

Moving to Hugo, part 1: Why Hugo

Rebuilding samarthya.me, part 2: Salvaging the content

The raw material #

Rebuilding samarthya.me, part 1: The day the blog fell

What I found #

Salvaging six years of posts

A copy of the crime scene

The blog went down

The defences went off

Casino posts under my name

The password worked

Someone was knocking

The raw material
#

What I found
#