Site is Hacked

KishoSRB

KishoSRB

Regular Member
Joined
Jan 5, 2015
Messages
320
Reaction score
129
Hi guys,

some of my sites are hacked.

I'm here to ask, does anybody have experience with some hackers who post content in bulk on file manager.

I have 10k shitty posts, sec op team from WPX deleted infected files, but the problem is not solved, they are over and over step ahead.

I'm not using any nulled plugin or theme, my pc is very clean, I'm not downloading anything from torrents, porn etc..

1636131026202.png
 
Advertise on BHW
It's possible that the themes have a backdoor in them, or the host you are using got hacked, or maybe a plugin has a vulnerability that got abused.

I had a similar problem a few years ago and what I did was just create a backup, delete everything and just restore the theme, content and everythin gelse
 
I had the same problem, they managed to access my files and kept modifying the .htaccess file, adding redirections for their weird blog posts.
I removed all their posts (they were all html files within a single folder that was named 'forum' which they added in the 'wp-content' folder to throw me off)
I downloaded the iThemes Security WP plugin (it allows preventing sketchy modifications to the htaccess file among other things) and Wordfence plugin.
Finally I added a 410 or 'content-deleted' redirection from any of their posts to my homepage. (all their added posts were in 'domain.com/forum/random_postname_here' so it was easy to just redirect domain.com/forum/* wildcard)
It took a few weeks for Google to realize they didn't exist anymore and the site started to rank again and has been rising in ranks ever since. Never had another problem with malware on my sites again, after installing the 2 plugins.
 
ANewBeginning said:
It's possible that the themes have a backdoor in them, or the host you are using got hacked, or maybe a plugin has a vulnerability that got abused.

I had a similar problem a few years ago and what I did was just create a backup, delete everything and just restore the theme, content and everythin gelse
Click to expand...
Its Astra free official theme
 
liquardo said:
I had the same problem, they managed to access my files and kept modifying the .htaccess file, adding redirections for their weird blog posts.
I removed all their posts (they were all html files within a single folder that was named 'forum' which they added in the 'wp-content' folder to throw me off)
I downloaded the iThemes Security WP plugin (it allows preventing sketchy modifications to the htaccess file among other things) and Wordfence plugin.
Finally I added a 410 or 'content-deleted' redirection from any of their posts to my homepage. (all their added posts were in 'domain.com/forum/random_postname_here' so it was easy to just redirect domain.com/forum/* wildcard)
It took a few weeks for Google to realize they didn't exist anymore and the site started to rank again and has been rising in ranks ever since. Never had another problem with malware on my sites again, after installing the 2 plugins.
Click to expand...
Exactly the same problem. Will try this after WPX's 4th time "cleaning"
 
liquardo said:
I had the same problem, they managed to access my files and kept modifying the .htaccess file, adding redirections for their weird blog posts.
I removed all their posts (they were all html files within a single folder that was named 'forum' which they added in the 'wp-content' folder to throw me off)
I downloaded the iThemes Security WP plugin (it allows preventing sketchy modifications to the htaccess file among other things) and Wordfence plugin.
Finally I added a 410 or 'content-deleted' redirection from any of their posts to my homepage. (all their added posts were in 'domain.com/forum/random_postname_here' so it was easy to just redirect domain.com/forum/* wildcard)
It took a few weeks for Google to realize they didn't exist anymore and the site started to rank again and has been rising in ranks ever since. Never had another problem with malware on my sites again, after installing the 2 plugins.
Click to expand...
Very nice, it is a great solution for hacked website
 
KishoSRB said:
Exactly the same problem. Will try this after WPX's 4th time "cleaning"
Click to expand...
Good luck, I hope it works out.

I assume just protection of system files in iThemes Security will do the trick after you've removed their redirections, but might as well browse all the other security features like hiding backend etc. and use Wordfence to scan your files as it might find some hidden malware they have left behind.
1636194600663.png
 
KishoSRB said:
Exactly the same problem. Will try this after WPX's 4th time "cleaning"
Click to expand...

As much as I like WPX, I had this issue 3 years back, someone brute forced onto a site and injected malware.
Site got flagged, they cleaned it. A week later the malware was back. It took them 3 attempts because they were just cleaning at the top level and not looking deep enough into the databases.
 
MisterF said:
As much as I like WPX, I had this issue 3 years back, someone brute forced onto a site and injected malware.
Site got flagged, they cleaned it. A week later the malware was back. It took them 3 attempts because they were just cleaning at the top level and not looking deep enough into the databases.
Click to expand...
Completely the same issue I have ...

My rankings are tanked, the site lost traffic..
 
Use WP all in one migration to keep a backup file
Use ithemes security to check for threats and reset the site
 
liquardo said:
I had the same problem, they managed to access my files and kept modifying the .htaccess file, adding redirections for their weird blog posts.
I removed all their posts (they were all html files within a single folder that was named 'forum' which they added in the 'wp-content' folder to throw me off)
I downloaded the iThemes Security WP plugin (it allows preventing sketchy modifications to the htaccess file among other things) and Wordfence plugin.
Finally I added a 410 or 'content-deleted' redirection from any of their posts to my homepage. (all their added posts were in 'domain.com/forum/random_postname_here' so it was easy to just redirect domain.com/forum/* wildcard)
It took a few weeks for Google to realize they didn't exist anymore and the site started to rank again and has been rising in ranks ever since. Never had another problem with malware on my sites again, after installing the 2 plugins.
Click to expand...
Is it safe to do 410 redirection with 2k fake posts (now 404 pages) to the homepage?

Thanks
 
KishoSRB said:
Is it safe to do 410 redirection with 2k fake posts (now 404 pages) to the homepage?

Thanks
Click to expand...
Yeah I think 410 is better than 404, since the content is intentionally deleted and not coming back. (worked for me with 300+ deleted posts, got no penalties and google de-indexed those URL's in a week or two)

I found this quote explaining the difference between the two from stackoverflow:
"This condition [the 410] is expected to be considered permanent. Clients with link editing capabilities SHOULD delete references to the Request-URI after user approval.
If the server does not know, or has no facility to determine, whether or not the condition is permanent, the status code 404 (Not Found) SHOULD be used instead."

The reason I used 410 in the first place was because some of the fake posts received a bit of traffic before google removed them from the index, so that turned into some homepage traffic instead :anyway:
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top