Help my site is mark as "This site may harm your computer" !
- Thread starter esi0411
- Start date
Fragmaster
Senior Member
- Apr 3, 2016
- 986
- 1,445
I had that problem in past with free hosting. They are always shared, and if any site on server is flagged as malicious, all sites hosted on same server will be tagged as dangerous (sometimes just that IP, sometimes entire IP class)
esi0411
Junior Member
- May 22, 2010
- 106
- 6
my site is not in free hosting, but in shared host , now hosting is scanning my account
just afraid it cannot back to normal since it movie streaming site, it need 9 months hard work to get traffic and now it drop
Rahulraj9674
Regular Member
- Aug 17, 2016
- 208
- 40
Go for a reputed hosting service like godaddy or hostgator as they keep cleaning malicious content from the server and keep them clean.. You may try vps and make sure you are not using any nulled theme or template as most of the time they contain malicious links in the code.
esi0411
Junior Member
- May 22, 2010
- 106
- 6
how do i change it, in my wordpress it had set to http://www.
and i just add in to googlewebmaster , google detect with http, https, www and without www
Capo Dei Capi
BANNED
- Oct 23, 2014
- 752
- 7,253
Are you using a crappy ad network? Many of them have 1 or more ads that may have malware.
esi0411
Junior Member
- May 22, 2010
- 106
- 6
i just using adcenter, but i see big movie streaming using this network , and they all fine
Zwielicht
Elite Member
- Aug 31, 2013
- 21,175
- 40,461
You just gave me an idea for a much needed service around here.
Anyway, you need to download all of the sample URLs and check each and every one of them using the "Fetch and Render as Google tool". If Google sees something different than your visitors, you have a problem. Scan your site for malware using Wordfence or Sucuri and try to find out if those programs detect any malware.
Like @Fragmaster said, sometimes when one site gets flagged on a shared host, the other sites will get flagged as well. However, if the sample URLs turn out to be real pages on your site that have been affected, then the problem is most likely your website.
I noticed you sent in a panic appeal. You should've waited a bit longer to send in an appeal. I typically send in information regarding site scans, what I did to resolve the issue, and what steps I took to secure the site even further. Whether or not doing this matters is up for debate, although my appeals never get rejected.
Anyway, you need to download all of the sample URLs and check each and every one of them using the "Fetch and Render as Google tool". If Google sees something different than your visitors, you have a problem. Scan your site for malware using Wordfence or Sucuri and try to find out if those programs detect any malware.
Like @Fragmaster said, sometimes when one site gets flagged on a shared host, the other sites will get flagged as well. However, if the sample URLs turn out to be real pages on your site that have been affected, then the problem is most likely your website.
If you can't edit it there, I believe you can change it manually from your wp-config file.
Canonicalisation issues! You need to register the www, non-www, http, and https versions of your website and set all of them to the preferred domain. You also need to use that preferred domain in your internal links as well as ensure that your the other URL variations direct to the preferred domain.and i just add in to googlewebmaster , google detect with http, https, www and without www
I noticed you sent in a panic appeal. You should've waited a bit longer to send in an appeal. I typically send in information regarding site scans, what I did to resolve the issue, and what steps I took to secure the site even further. Whether or not doing this matters is up for debate, although my appeals never get rejected.
Last edited:
esi0411
Junior Member
- May 22, 2010
- 106
- 6
will install Wordfence and do a scan , well i know nothing about Canonicalisation but i will try consult with my hosting and get SSL. iam suspect this canonicalisation is the issue and the ads/CPA network thats put PPD for third country
Zwielicht
Elite Member
- Aug 31, 2013
- 21,175
- 40,461
Visit your website and go to the HTTPS and HTTP versions of your website. When you go to whichever URL you don't normally use, is that URL accessible, or does it redirect to the one you use?
The page below will tell you everything you need to know.
https://support.google.com/webmasters/answer/139066?hl=en
Other resources you need to read:
https://moz.com/learn/seo/canonicalization
https://www.mattcutts.com/blog/seo-advice-url-canonicalization/
esi0411
Junior Member
- May 22, 2010
- 106
- 6
https is not accessible (but i think this just can be solve if i have a ssl)
Security issue type,URL,Date,Sample snippet
Malware,https://www.watchonline.red/khamoshiyan-silences-have-secrets-2015-watch-online
Malware,http://www.watchonline.red/tag/the-danish-girl-with-english-subtitles
Malware,https://www.watchonline.red
Malware,http://www.watchonline.red
Malware,http://watchonline.red/tag
Malware,http://www.watchonline.red/tag
Malware,http://watchonline.red/tag/the-danish-girl-with-english-subtitles
Malware,http://www.watchonline.red/redboxmovies
Malware,http://watchonline.red
Malware,https://www.watchonline.red/tag/the-danish-girl-with-english-subtitles
Malware,http://www.watchonline.red/page/1
Malware,http://www.watchonline.red/khamoshiyan-silences-have-secrets-2015-watch-online
Malware,http://www.watchonline.red/fifty-shades-of-grey-2015-watch-online
Malware,https://www.watchonline.red/fifty-shades-of-grey-2015-watch-online
Zwielicht
Elite Member
- Aug 31, 2013
- 21,175
- 40,461
All right, that's good. Don't worry about enabling SSL right now, worry about removing the malware first.
Back to the hacked site problem, did your web host ever get back to you when you contacted them? Also, did you upload Wordfence/Sucuri/iThemes and use it to scan your site?
I don't like Sucuri's external scanner, but here the results if you're interested. https://sitecheck.sucuri.net/results/www.watchonline.red
esi0411
Junior Member
- May 22, 2010
- 106
- 6
hi Zwielicht
after a install and scanned with Wordfence, i found a weird script before close of head and all my theme in that domain had that script, download same, frees theme and compare, the frees one dont had that script, one fore sure . the script contain hxxxp://hcl.gr that also mark as malware site
and i had removed it now,
btw the hosting support report with not virus/malware detected after do a scan
Zwielicht
Elite Member
- Aug 31, 2013
- 21,175
- 40,461
Did the web host mention if there was any malware before the scan, though?hi Zwielicht
after a install and scanned with Wordfence, i found a weird script before close of head and all my theme in that domain had that script, download same, frees theme and compare, the frees one dont had that script, one fore sure . the script contain hxxxp://hcl.gr that also mark as malware site
and i had removed it now,
btw the hosting support report with not virus/malware detected after do a scan
I can't read php well, but assuming that was the cause of the problem, your next step would be to find out how the script got into your site and if the hacker left any backdoor scripts in one of the files in order to get back in.
Read through the guides below.
https://codex.wordpress.org/FAQ_My_site_was_hacked
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
If you have any backups from a time before your site was hacked, you can try restoring your site that way and then securing it. Also ask your web host if any other sites on the same server were compromised.
What I did for one client was completely wipe everything from their server and rebuild the site from scratch. It was an extreme case where the site had been hacked for years, so I salvaged what I could, rebuilt the site, and the site hasn't been hacked since.
esi0411
Junior Member
- May 22, 2010
- 106
- 6
i just ask for virus scan for my account, after they do a scan they said no anything found AND i no have any backup,
after i check my other domain (in same web host account) all my site had that script and in same spot, and one more site is get mark "This site may harm your computer"
duomaxwell
Newbie
- Oct 8, 2015
- 33
- 14
You definitely got hacked. It looks like from the script you posted above it was performing some sort of session hijacking. The script was pointing to that hcl site.
Also, using WordPress for anything is quite risky. If you have any programming skills, just build yourself a simple CRUD style site using a popular web framework, and you'll be infinitely more protected than what you're currently using. I'm also in the movie niche. Just out of curiosity how much are you making per day?
Also, using WordPress for anything is quite risky. If you have any programming skills, just build yourself a simple CRUD style site using a popular web framework, and you'll be infinitely more protected than what you're currently using. I'm also in the movie niche. Just out of curiosity how much are you making per day?