Answered Internal Pages Not Working - Username Not Found ... 9-11!

Client just called me this afternoon saying they can't get to any internal pages; homepage loads fine, nor can they log in. They username/password (which I also have access to) is not longer working and MODX says that user is not recognize. "The username or password you entered is incorrect. Please check the username, re-type the password, and try again."

My fear is the extreme: hacked or something of that nature. But I'm going to be cautiously optimistic and think it's AWS (their hosting provider). But, I'd love a 2nd or 3rd opinion. Since I can't log in to MODX to see error logs or have access to their hosting ... what would be advisable?

You can see the MODX error log in cPanel's File Manager (or with FTP): core/cache/logs/error.log. While you're there (after you've copied the content of the error log somewhere), delete all files in the core/cache directory. It may be just cache corruption.

Check the modx_users table in PhpMyAdmin to see if there are any extra users, and see if the fields look OK for the admin user.

Check the modx_site_plugins table to see if there are any non-MODX plugins (core services is common in hacked sites).

Take a quick look at the root index.php and .htaccess to look for signs of hacking.

If there's no cPanel access, it's time to change hosts.