Website hacked. Need help.

[Black Belt Spodermen]

I am seeing a lot of random new pages in GSC that are redirecting to a Japanese website even though those pages don't exist. I want to know what should I do.

 

[Diplomat]

I am seeing a lot of random new pages in GSC that are redirecting to a Japanese website even though those pages don't exist. I want to know what should I do.

Are you using WordPress? Also, show us the URL of those new pages you are seeing.

 

[TheMarquis]

Follow my advice here: https://www.blackhatworld.com/seo/my-website-has-been-hacked-i-need-help.1486885/#post-16253459

 

[Black Belt Spodermen]

Are you using WordPress? Also, show us the URL of those new pages you are seeing.

 

[Diplomat]

Follow my advice here: https://www.blackhatworld.com/seo/my-website-has-been-hacked-i-need-help.1486885/#post-16253459

It's nearly impossible to get rid of files that have been hacked if you are using WordPress. Very often, those hacks spread their code across a large number of files, and identifying those files is a mess.

Fixing a WordPress website is fairly easy. Just delete all files and folders besides wp-config.php (clean it up manually, if needed) and wp-content/uploads folder. Then, just upload all new WordPress files, reinstall your theme and plugins, and you are good to go. I'd never recommend restoring a backup because you never know when your stuff got infected. Just because you delete suspicious files doesn't mean there aren't more of them.

 

[Diplomat]

View attachment 296677

You didn't say if are you using WordPress. Do those files actually exist?

 

[Black Belt Spodermen]

It's nearly impossible to get rid of files that have been hacked if you are using WordPress. Very often, those hacks spread their code across a large number of files, and identifying those files is a mess.

Fixing a WordPress website is fairly easy. Just delete all files and folders besides wp-config.php (clean it up manually, if needed) and wp-content/uploads folder. Then, just upload all new WordPress files, reinstall your theme and plugins, and you are good to go. I'd never recommend restoring a backup because you never know when your stuff got infected. Just because you delete suspicious files doesn't mean there aren't more of them.

I went into the directory and saw some new weird files into the root folder. After deleting them, I installed a security plugin and also enabled two-factor authentication.

Thankfully, now the pages are not redirecting. Fortunately, this hack was not that deep otherwise, it could have been a mess solving this.

 

[Diplomat]

I went into the directory and saw some new weird files into the root folder. After deleting them, I installed a security plugin and also enabled two-factor authentication.

Thankfully, now the pages are not redirecting. Fortunately, this hack was not that deep otherwise, it could have been a mess solving this.

Ensure you keep your WordPress installation up to date with plugins and the theme.

One main reason, if not the most common one, is that people haven't updated their plugins and themes, and a "hack" is uploaded through there. Just enable auto updates, and it's all good.

 

[Black Belt Spodermen]

Ensure you keep your WordPress installation up to date with plugins and the theme.

One main reason, if not the most common one, is that people haven't updated their plugins and themes, and a "hack" is uploaded through there. Just enable auto updates, and it's all good.

Yup. However, the main reason here for the hack was malware installed on my computer.

Recently, I downloaded a cracked application without realizing that my anti-virus was off. I am getting account hack on almost every platform daily. So, I just resetted everything, installed a premium anti-virus, removed the cracked application, reset the passwords, and turned-on two factor authentication.