Roger Stone's StoneZONE site wiped in hack, restored from backup

Roger Stone and his team report that StoneZONE.com — a political commentary site he has run for more than 20 years — was hacked on Monday, October 26, 2026, and that attackers deleted the site’s archive of articles. In a Stone Cold Truth (Substack) post, his team says daily backups and an IT crew restored the site in under an hour, and that the FBI was notified. Stone has suggested the timing followed an anti–Ukraine-aid article, but no attacker, method, or independent forensic report has been published.

For Texas small businesses, law firms, advisors, and local governments with long-running websites, the lesson is practical: destruction beats defacement. A working offsite, versioned backup — tested on a schedule — can turn a wipe into a short outage instead of a lost decade of content.

As of November 1, 2026, stonezone.com answers over HTTPS with a live WordPress homepage (we see WordPress 7.1.4 in public signals). That confirms availability today; it does not by itself prove what happened on October 26. We found no major wire-service or security-vendor write-up of the incident; Slingshot News and Dissent Watch republish Stone-aligned accounts. Treat operational details as Stone’s team’s account unless another party confirms them.

Snapshot

What happened

What Stone’s team claims

• On October 26, 2026, StoneZONE.com was compromised and the published article archive was wiped, not merely defaced.
• Stone’s X post (timestamp cited in the Substack piece: 11:52 PM that day) said the site was deleted and that his IT staff held a complete copy.
• The Substack article says daily backups allowed a full restore in less than an hour and that the FBI was notified.
• Stone has suggested retaliation linked to his commentary on Ukraine aid; that is his claim — no evidence of motive or attribution appears in the published account.

What we could confirm independently

• November 1, 2026: stonezone.com returns HTTP 200 with WordPress REST and generator signals (7.1.4), PHP 8.3.x, and LiteSpeed cache headers — consistent with a restored production site, not a parked domain.
• No attacker name, CVE, or compromise timeline from a neutral third party.

What remains unknown

• Whether files, databases, or admin accounts were exfiltrated before the wipe.
• Whether the same actors hit other Stone properties (his team mentioned a separate menswear site in podcast remarks republished online — not verified here).

Why backups mattered

Ransomware dominates headlines, but wiper-style website destruction still happens: attackers with CMS, hosting, or stolen admin credentials can empty posts, media, and themes faster than a help desk ticket queue.

Stone’s team attributes recovery to routine daily backups and a restore completed in under an hour. Whether that matches your environment or not, the pattern is familiar from municipal and clinic outages:

• Versioned, offsite copies — not the same login as production WordPress.
• Restore drills — prove you can rebuild posts, uploads, and config on clean hardware.
• Immutable or WORM storage — so a stolen admin session cannot delete last night’s backup too.

Pair backups with patching and MFA on the accounts that can publish or purge content — see WordPress wp2shell and PHP2Shell for why unpatched core and PHP still matter on self-hosted WordPress.

How to protect your website

1. Automate daily offsite backups with retention (30+ days) and versioning; store at least one copy outside the hosting control panel login.
2. Test restores quarterly — database and wp-content uploads — on a staging hostname.
3. Separate credentials for backup SaaS, DNS, registrar, and CMS admin; no password reuse.
4. Least-privilege CMS users — authors should not install plugins; only break-glass accounts get administrator.
5. Patch WordPress core, themes, and plugins on a schedule; remove unused plugins.
6. Registrar lock and DNS change alerts on the domain that hosts your public site.
7. Logging — enable web server and WordPress audit logs where available; ship copies off-box.
8. DMARC p=reject (and aligned SPF/DKIM) on the domain you use for @yourcompany.com mail so attackers cannot easily spoof your brand after an incident.

Chamber and bar monthly guides echo the same backup discipline: Texas chambers cyber monthly (Aug 2026) · Texas bar associations cyber monthly (Aug 2026).

MFA: YubiKey and Google Authenticator

Website wipes usually start with stolen hosting or CMS credentials. Phishing-resistant MFA on every account that can delete content or DNS records is baseline hygiene.

Self-hosted WordPress has no built-in MFA; the official Two-Factor plugin documents Google Authenticator-class TOTP, and WebAuthn adds hardware keys as a separate install. Cloudflare 2FA and WordPress.com security keys document YubiKey-class options. Google Account MFA protects Workspace mail, not your CMS — you still need hosting and WordPress factors.

StoneZONE’s public DNS uses Epik nameservers; we did not cite Epik MFA here because we have not graded that registrar in our MFA directory.

Directory: MFA support directory · Infrastructure and Email & Identity.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited stonezone.com and Stone’s stonecoldtruth.com newsletter domain on November 1, 2026. 100% is the ideal — neither reaches it. These scores measure public email authentication, transport, and website security headers — not whether a CMS backup exists or whether a hack occurred.

stonezone.com is a self-hosted WordPress site. stonecoldtruth.com is Stone’s newsletter custom domain on Substack — the audit reflects that domain’s mail and headers, not Substack’s shared platform console.

Audit links: stonezone.com · stonecoldtruth.com

Both domains score 25% on Identity and 37% on Website security headers — gaps that matter if attackers spoof @stonezone.com mail or clone the site after a CMS incident. Transport (15%) reflects missing MTA-STS enforce-class signals on the public audit, not the headline 42% overall alone.

Blacklist and lookalike domains

Email blacklist checks (public DoH, November 1, 2026): stonezone.com showed one list hit — 66.223.49.20 (MX) on SPFBL. That pattern often reflects shared hosting mail rather than a site-specific spam campaign; verify on the vendor site if deliverability matters.

stonecoldtruth.com was clear in the same pass.

DNS lookalike scans for stonezone.com (BEC profile, registered signals only, November 1, 2026):

Registered names to investigate, not proof this hack used them:

Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• WordPress wp2shell unauthenticated RCE
• PHP2Shell emergency PHP patches
• Universal Plant Services — Chaos ransomware wiping behavior
• MFA support directory

Check your domain free at audit.emailmenow.com, or see automated reports and monitoring.

Sources: Roger Stone — StoneZONE hacked (Stone Cold Truth / Substack) · Stone X post timing quoted in that piece (~Oct 26, 2026, 11:52 PM) · Live checks of stonezone.com (Nov 1, 2026) · Independent EmailMeNow audits, blacklist, and cybersquat probes November 1, 2026. Domain scores: audit.emailmenow.com only.