Website Hacked

StrixSeo

StrixSeo

Elite Member
Jr. VIP
Joined
Jul 25, 2013
Messages
7,476
Reaction score
1,916
Hi guys,

One of my client WordPress site got hacked one week ago, and I am not sure because I checked all the files nothing found. everything is normal but still, it's generating again and again and indexing in google.

http://prntscr.com/nlho4i

it's the same type of issue as discussed in this thread https://www.blackhatworld.com/seo/website-hacked.1096530/

Anyone can help me with this?

Thanks
strixmedia
 
Advertise on BHW
It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week
 
For starters install Cloudfence, perform scan of all files with this plugin. It should detect some stuff, that should help you isolate the hacked files.
 
Seoking77 said:
It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week
Click to expand...

Yeah, I changed to another hosting, even theme and plugins too but still can't fix it.
 
Seoking77 said:
It's server problem..... In server they get virus.... I face same issue with my money site some week ago..... I change my hosting and all thing will ok in just 2 week
Click to expand...
Yeah maybe you don't have any files on your ftp account but someone might have control over the whole server :)
 
legion85 said:
For starters install Cloudfence, perform scan of all files with this plugin. It should detect some stuff, that should help you isolate the hacked files.
Click to expand...

I already tried with wordfrence,anti-malware, sucuri, ithemesecurity, Its says 0 virus/malware/spam detections. Any expert here plz?
 
Does it generate pages that you can see in wp-admin and delete them? What if you disable all plugins and wait a bit to see if the pages will be re-generated? If not, you could try turning each plugin on one by one and find the culprit?

I'm doing a bit of guessing, but that is what I would try.
 
legion85 said:
Does it generate pages that you can see in wp-admin and delete them? What if you disable all plugins and wait a bit to see if the pages will be re-generated? If not, you could try turning each plugin on one by one and find the culprit?

I'm doing a bit of guessing, but that is what I would try.
Click to expand...

:(No, I can't see them on Wordpress, I don't know where it's coming from. I deactivate all the plugins one by one it's still coming. can you please look on this
https://www.blackhatworld.com/seo/website-hacked.1096530/ have you got anything legion?
 
Probably shit hosting whole shared server is rooted by hackers.

Shift to new hosting asap
 
I had this too.
The issue is on the hosting side. They hack in at the hosting level.

Since you moved to a new host the only issue left is in Google SERP. They also submitted a site map to google search console. You must remove that and submit your own. I also added a plugin 404 to 410 to signify all 404 pages were dead. It removed most of the 10,000+ pages in the SERP within a few weeks. I still had one or two pages that just wouldn't go away so I manually removed them in search console.
 
Rj268 said:
I had this too.
The issue is on the hosting side. They hack in at the hosting level.

Since you moved to a new host the only issue left is in Google SERP. They also submitted a site map to google search console. You must remove that and submit your own. I also added a plugin 404 to 410 to signify all 404 pages were dead. It removed most of the 10,000+ pages in the SERP within a few weeks. I still had one or two pages that just wouldn't go away so I manually removed them in search console.
Click to expand...

Yeah, this is what I am doing right now, removing the 404 pages and I did no-index to search result pages as @Nut-Nights said. Thanks for the help guys.:)
 
Loads of stupid shit in this thread.

StrixMedia said:
Yeah, I changed to another hosting, even theme and plugins too but still can't fix it.
Click to expand...

That's because it has nothing to do with the server or web hosting provider (in 99.9% of the cases). It's your website that's broken.

We have seen such "hack" on a few domains, and the fix is quite easy. Delete all Wordpress files besides wp-config.php and upload everything again.
You can't fix such things with moving to a new host when your website files are infected. Wordpress has just too many files to check manually, and "hack" checking plugins can't just do a good enough job to "fix/find" those issues.

What you could do is ask your host to disable eval function (it can't be done just by adding eval to disable_function field in PHP config).
It would help out a lot because most of those hacks are using eval function.

Once the issue with those fake pages is fixed, Google will deindex them eventually because they are producing 404 (if they are actual pages). If they are search queries, then the best thing you can do is to prevent Google from indexing search results. This is another thing that we have noticed. Tons of Japanese/Chinese search queries.
 
Hey mate
Kindly Check the Below Things
1. Check the .htaccess
2. Disable all plugins and themes in wp-content folder or rename the plugin and themes folder
3. If you are using VPS change the default port 22 to some other
4. Check the active process in your VPS
5. Check the file manage any other wordpress files are added
6. Check WP-config.php
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top