I noticed collections popping up and new tags on my products that were not added by me. I delete and they come right back. This, in turn, screws up all my products and whether they are even on my actual site. I keep looking at my page from a customer view and sub-categories will be empty.
I hope I found the problem with that, which is an app by Power Tools for a filter sidebar.
However, I am still concerned that it was hacked because when I go to log in, it says there’s been too many attempts (not by me). I add correct info, prove I’m a human, then the page won’t load.
I’m glad to hear you resolved your issue regarding your tags that were being added by the app, but sorry to hear you’re having issues logging in. Thanks for the screenshots as well.
The message that’s appearing saying there have been too many attempts as well as the ReCaptcha are not something Shopify has control over, as it’s run by Google (the underlying infrastructure). You’ll need to wait until that message does not appear anymore in order to login, or alternatively, you can try to login from a different IP address. While I can’t say for sure how long it will take, I’d guess a few hours. Do you have another location / IP you can try logging in from?
As far as someone else accessing your account, are there any other changes on your store that concern you, and make you believe someone may have accessed your account? Do you have any staff members, or have you ever given access to anyone else? I’d recommend looking through your activity feed once you’re able to log in again, and seeing if there are other changes you’re not aware of.
I have given two developers access before to fix something that must be
complicated because I still have trouble.
I don’t see them in the activity log but wasn’t sure if there might be a
way around that.
I’m just concerned about who is trying to log in so many times that I’m
locked out.
Thanks for the reply. Have you been able to access your account again without receiving this error? I hope this is the case!
I definitely understand your concern over who may be attempting to log in here, but it’s hard for us to know exactly what was causing this error before. From my understanding, the attempts would be coming from your IP, since this is the IP that was blocked temporarily.
Regardless of the cause, to be safe, I’d recommend changing your password, as well as removing any staff accounts that are no longer in use. Removing staff accounts once they are no longer in use is always best practice.
Lastly, for increased security, we recommend enabling two-step authentication. This process will provide a more secure login process. If you enable this, when you sign in, you’ll need to enter your password as well as authenticate through a mobile app, SMS text message, security key, or biometric sensors.
Did you notice any unusual events in your activity feed in the end?
