Website Hacked

[StrixSeo]

Hi guys,

One of my client WordPress site got hacked one week ago, and I am not sure because I checked all the files nothing found. everything is normal but still, it's generating again and again and indexing in google.

http://prntscr.com/nlho4i

it's the same type of issue as discussed in this thread https://www.blackhatworld.com/seo/website-hacked.1096530/

Anyone can help me with this?

Thanks
strixmedia

 

[Seoking77]

It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week

 

[legion85]

For starters install Cloudfence, perform scan of all files with this plugin. It should detect some stuff, that should help you isolate the hacked files.

 

[StrixSeo]

It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week

Yeah, I changed to another hosting, even theme and plugins too but still can't fix it.

 

[rashow]

It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week

Yeah maybe you don't have any files on your ftp account but someone might have control over the whole server

 

[rashow]

Yeah, I changed to another hosting, even theme and plugins too but still can't fix it.

Oh never mind i didn't see this before i posted

 

[StrixSeo]

For starters install Cloudfence, perform scan of all files with this plugin. It should detect some stuff, that should help you isolate the hacked files.

I already tried with wordfrence,anti-malware, sucuri, ithemesecurity, Its says 0 virus/malware/spam detections. Any expert here plz?

 

[legion85]

Does it generate pages that you can see in wp-admin and delete them? What if you disable all plugins and wait a bit to see if the pages will be re-generated? If not, you could try turning each plugin on one by one and find the culprit?

I'm doing a bit of guessing, but that is what I would try.

 

[Mr Positive]

Consult with @Festinger he should be able to help

 

[StrixSeo]

Does it generate pages that you can see in wp-admin and delete them? What if you disable all plugins and wait a bit to see if the pages will be re-generated? If not, you could try turning each plugin on one by one and find the culprit?

I'm doing a bit of guessing, but that is what I would try.

No, I can't see them on Wordpress, I don't know where it's coming from. I deactivate all the plugins one by one it's still coming. can you please look on this
https://www.blackhatworld.com/seo/website-hacked.1096530/ have you got anything legion?

 

[kaviraj008]

@StrixMedia Check the below article

https://developers.google.com/web/fundamentals/security/hacked/fixing_the_japanese_keyword_hack

 

[Bigdadddy]

Probably shit hosting whole shared server is rooted by hackers.

Shift to new hosting asap

 

[Rj268]

I had this too.
The issue is on the hosting side. They hack in at the hosting level.

Since you moved to a new host the only issue left is in Google SERP. They also submitted a site map to google search console. You must remove that and submit your own. I also added a plugin 404 to 410 to signify all 404 pages were dead. It removed most of the 10,000+ pages in the SERP within a few weeks. I still had one or two pages that just wouldn't go away so I manually removed them in search console.

 

[StrixSeo]

I had this too.
The issue is on the hosting side. They hack in at the hosting level.

Since you moved to a new host the only issue left is in Google SERP. They also submitted a site map to google search console. You must remove that and submit your own. I also added a plugin 404 to 410 to signify all 404 pages were dead. It removed most of the 10,000+ pages in the SERP within a few weeks. I still had one or two pages that just wouldn't go away so I manually removed them in search console.

Yeah, this is what I am doing right now, removing the 404 pages and I did no-index to search result pages as @Nut-Nights said. Thanks for the help guys.

 

[Diplomat]

Loads of stupid shit in this thread.

Yeah, I changed to another hosting, even theme and plugins too but still can't fix it.

That's because it has nothing to do with the server or web hosting provider (in 99.9% of the cases). It's your website that's broken.

We have seen such "hack" on a few domains, and the fix is quite easy. Delete all Wordpress files besides wp-config.php and upload everything again.
You can't fix such things with moving to a new host when your website files are infected. Wordpress has just too many files to check manually, and "hack" checking plugins can't just do a good enough job to "fix/find" those issues.

What you could do is ask your host to disable eval function (it can't be done just by adding eval to disable_function field in PHP config).
It would help out a lot because most of those hacks are using eval function.

Once the issue with those fake pages is fixed, Google will deindex them eventually because they are producing 404 (if they are actual pages). If they are search queries, then the best thing you can do is to prevent Google from indexing search results. This is another thing that we have noticed. Tons of Japanese/Chinese search queries.

 

[uswin4224]

do you guys think, cloudwayd with linode is relatively safe from hack ?

 

[Diplomat]

do you guys think, cloudwayd with linode is relatively safe from hack ?

No

 

[Trained Wolf]

Hey mate
Kindly Check the Below Things
1. Check the .htaccess
2. Disable all plugins and themes in wp-content folder or rename the plugin and themes folder
3. If you are using VPS change the default port 22 to some other
4. Check the active process in your VPS
5. Check the file manage any other wordpress files are added
6. Check WP-config.php