Wordpress Hacked - Link Injection

So i was browsing the BHW homepage and this post caught my eye
https://www.blackhatworld.com/seo/e...ilding-strategy-how-can-i-do-the-same.995172/

This triggered my memories when my entire fyckin server was infected by JS attack (https://blog.sucuri.net/2017/04/wor...-redirects-via-infected-javascript-files.html)

So I checked checked one of my site whose ranking recently got down, and to my surprise the site has fyckin shitty links to crap pharmacy sites like these.


They are using this link format and those posts were modified during 12 - 15 NOV



Bad thing is Google actually lower my site ranking due to these fyckers ...

Steps Taken So Far

1. Remove the links
2. Remove admin user. Add new user with new pass
3. Install a NOFOLLOW plugin that nofollows all the outgoing links, except the ones I whitelisted

In process:
Theme check
Plugins Check
Check the IP of login
Install a two factor login pluign
find a way to lock the post modification

An advice to people out there = If your website has recently lose some rankings like from 3 to 17, check your posts and pages for link injection.


I am reporting these sites to every security forum or service i can find. It may not do much but ia m fucking pissed

Just advice to use this checker (revisium.com/aibo/) and OWASP ZAP if you can handle it.

I had same thing. Nulled plugin was the case. Thats why I separate each wp installation from other folders on my server (other domains). this way only one domain gets infected.

Funny, my website immediately dropped in rankings from 3 to 17. or something like that.

Clean the whole install as problems can recur.

aidenhera said:

I had same thing. Nulled plugin was the case. Thats why I separate each wp installation from other folders on my server (other domains). this way only one domain gets infected.

Funny, my website immediately dropped in rankings from 3 to 17. or something like that.

Click to expand...

Exactly. This means google crawler is considering external links. If you link to a pharmacy related website then your ranking will drop immediately.

Btw, what do you mean by separate folders for wordpress?

seoz87 said:

Exactly. This means google crawler is considering external links. If you link to a pharmacy related website then your ranking will drop immediately.

Btw, what do you mean by separate folders for wordpress?

Click to expand...

you can separate domain folder from other content in public_html. (such as other domains). at least its possible in my hosting panel

thank you for your advice

aidenhera said:

you can separate domain folder from other content in public_html. (such as other domains). at least its possible in my hosting panel

Click to expand...

you mean every addon domain has its own folder? right, but all in main pulbic_html

i would reinstall everything and dont use nulled themes and plugins.

Wordfence helps too. Easy enough to block their IP, assuming they're not using a proxy.

aidenhera said:

Nulled plugin was the case.

Click to expand...

Greed begets poverty.

Discussion here: https://www.blackhatworld.com/seo/wordfence-expose-bhw-link-seller.995734/

Check with your hosting company for any hidden script/file you need removed. Best to just redo everything from scratch.