Wordpress URL redirect hack, how to resolve? Suggest Me!!

Discussion in 'Blogging' started by CrazyAnimal, Dec 2, 2016.

  1. CrazyAnimal

    CrazyAnimal Junior Member

    Joined:
    Jun 2, 2014
    Messages:
    123
    Likes Received:
    26
    Occupation:
    Internet Marketer
    Location:
    Just around the corner!!
    Hello,

    Need your support. Here my website homepage has been affected from "URL redirect hack" (other pages are working fine)

    [​IMG]

    I cross check all the files, And the found this code in index page, I removed the code and then i try it shows same redirect issue. :( How to solve this issue??

    [vc_row][vc_column width="1/1"][vc_empty_space height="32px"][/vc_column][/vc_row][vc_row][vc_column width="1/2"][vc_raw_html]JTNDdGFibGUlMjB3aWR0aCUzRCUyMjEwMCUyNSUyMiUyMGJvcmRlciUzRCUyMjAlMjIlMjBjZWxsc3BhY2luZyUzRCUyMjAlMjIlMjBjZWxscGFkZGluZyUzRCUyMjAlMjIlMjBzdHlsZSUzRCUyMmJvcmRlciUzQW5vbmUlM0IlMjIlM0UlMEElMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RkJTIwd2lkdGglM0QlMjI0OSUyNSUyMiUzRSUzQ2ltZyUyMHNyYyUzRCUyMmh0dHAlM0ElMkYlMkZ3d3cuZml2ZXB2ZW50dXJlLmNvbSUyRndwLWNvbnRlbnQlMkZ1cGxvYWRzJTJGMjAxNSUyRjExJTJGdHJhbnNmb3JtaW5nVGh1bS0xMS5qcGclMjIlMjB3aWR0aCUzRCUyMjI5OCUyMiUyMGhlaWdodCUzRCUyMjE3NyUyMiUyMCUyRiUzRSUzQyUyRnRkJTNFJTBBJTIwJTIwJTIwJTIwJTNDdGQlMjB3aWR0aCUzRCUyMjUxJTI1JTIyJTIwYWxpZ24lM0QlMjJjZW50ZXIlMjIlMjB2YWxpZ24lM0QlMjJtaWRkbGUlMjIlM0UlM0NoNCUyMHN0eWxlJTNEJTIyJTBBJTIwJTIwJTIwJTIwcGFkZGluZy1sZWZ0JTNBJTIwNXB4JTNCJTBBJTIyJTNFJTNDYSUyMHN0eWxlJTNEJTIyY29sb3IlM0ElMjAlMjM1ZDlhYjIlM0IlMjIlMjBocmVmJTNEJTIyaHR0cCUzQSUyRiUyRnd3dy5maXZlcHZlbnR1cmUuY29tJTJGYWJvdXQtZml2ZSUyRiUyMiUzRVRyYW5zZm9ybWluZyUyMFZpbGxhZ2VzLi4uJTIwJTNDaSUyMGNsYXNzJTNEJTIyaWNvbi1yaWdodC1vcGVuJTIwdGhlbWVjb2xvciUyMiUzRSUzQyUyRmklM0UlM0MlMkZhJTNFJTNDJTJGaDQlM0UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUzQyUyRnRyJTNFJTBBJTNDJTJGdGFibGUlM0UlMEE=

    [/vc_raw_html][/vc_column][vc_column width="1/2"][vc_raw_html]JTNDdGFibGUlMjB3aWR0aCUzRCUyMjEwMCUyNSUyMiUyMGJvcmRlciUzRCUyMjAlMjIlMjBjZWxsc3BhY2luZyUzRCUyMjAlMjIlMjBjZWxscGFkZGluZyUzRCUyMjAlMjIlMjBzdHlsZSUzRCUyMmJvcmRlciUzQW5vbmUlM0IlMjIlM0UlMEElMjAlMjAlM0N0ciUzRSUwQSUyMCUyMCUyMCUyMCUzQ3RkJTIwd2lkdGglM0QlMjI0OSUyNSUyMiUzRSUzQ2ltZyUyMHNyYyUzRCUyMmh0dHAlM0ElMkYlMkZ3d3cuZml2ZXB2ZW50dXJlLmNvbSUyRndwLWNvbnRlbnQlMkZ1cGxvYWRzJTJGMjAxNSUyRjExJTJGdHJhbnNmb3JtaW5nVGh1bS0yLmpwZyUyMiUyMHdpZHRoJTNEJTIyMjk4JTIyJTIwaGVpZ2h0JTNEJTIyMTc3JTIyJTIwJTJGJTNFJTNDJTJGdGQlM0UlMEElMjAlMjAlMjAlMjAlM0N0ZCUyMHdpZHRoJTNEJTIyNTElMjUlMjIlMjBhbGlnbiUzRCUyMmNlbnRlciUyMiUyMHZhbGlnbiUzRCUyMm1pZGRsZSUyMiUzRSUzQ2g0JTIwc3R5bGUlM0QlMjIlMEElMjAlMjAlMjAlMjBwYWRkaW5nLWxlZnQlM0ElMjA1cHglM0IlMEElMjIlM0UlM0NhJTIwc3R5bGUlM0QlMjJjb2xvciUzQSUyMCUyMzVkOWFiMiUzQiUyMiUyMGhyZWYlM0QlMjJodHRwJTNBJTJGJTJGd3d3LmZpdmVwdmVudHVyZS5jb20lMkZjcmVhdGUteW91ci1vd24taGFuZHdvdmVuLXRleHRpbGUtZGVzaWducyUyRiUyMiUzRUNyZWF0ZSUyMHlvdXIlMjBvd24lMjBIYW5kd292ZW4lMjB0ZXh0aWxlJTIwZGVzaWduLi4uJTIwJTNDaSUyMGNsYXNzJTNEJTIyaWNvbi1yaWdodC1vcGVuJTIwdGhlbWVjb2xvciUyMiUzRSUzQyUyRmklM0UlM0MlMkZhJTNFJTNDJTJGaDQlM0UlM0MlMkZ0ZCUzRSUwQSUyMCUyMCUzQyUyRnRyJTNFJTBBJTNDJTJGdGFibGUlM0UlMEE=


    Anybody facing this issue, please share your suggestions. Thanks
     
  2. Luckygiftcard2010

    Luckygiftcard2010 Junior Member

    Joined:
    Sep 6, 2013
    Messages:
    150
    Likes Received:
    6
    Location:
    Vietnam
    This script is in a plugin or some file in the themes ?
     
  3. CrazyAnimal

    CrazyAnimal Junior Member

    Joined:
    Jun 2, 2014
    Messages:
    123
    Likes Received:
    26
    Occupation:
    Internet Marketer
    Location:
    Just around the corner!!

    Its not in the plugin, it's in index file. [Pages -> Home ]
     
  4. Trained Wolf

    Trained Wolf Jr. VIP Jr. VIP

    Joined:
    Oct 30, 2014
    Messages:
    1,122
    Likes Received:
    203
    Gender:
    Male
    Occupation:
    Content Writer and PBN Provider
    Location:
    Graveyard
    Home Page:
    try this plugin All in one WP Security and contact your hosting provider
     
  5. CrazyAnimal

    CrazyAnimal Junior Member

    Joined:
    Jun 2, 2014
    Messages:
    123
    Likes Received:
    26
    Occupation:
    Internet Marketer
    Location:
    Just around the corner!!

    Already i used the security plugin "Wordfence Security", After scanned our website is not open, so i have deactivate this plugin.
    Let me try "All In One WP Security & Firewall" and let you know. Thanks for your help.
     
  6. MisterF

    MisterF Moderator Staff Member Moderator Jr. VIP

    Joined:
    Nov 29, 2009
    Messages:
    11,493
    Likes Received:
    10,893
    Occupation:
    Conference Organiser, Business Advisor.,
    Location:
    JADIP
    Home Page:
    Have you used a nulled theme or anything ?
     
  7. rubbishhorse

    rubbishhorse Newbie

    Joined:
    Apr 23, 2014
    Messages:
    11
    Likes Received:
    2
    Check your .htaccess file. I had one like this that I couldn't figure out for the life of me. It was a redirect within the htaccess file but the sneaky buggers had put it way down the bottom of the file so I had to scroll down quite a bit to find it.
     
  8. incognitus

    incognitus Registered Member

    Joined:
    Oct 4, 2014
    Messages:
    59
    Likes Received:
    12
    Location:
    on a VPS
    The code you see is Visual Composer code. Do you use VC on your site?
     
  9. Unfodos

    Unfodos Junior Member

    Joined:
    Mar 10, 2014
    Messages:
    180
    Likes Received:
    77
    Gender:
    Male
    Occupation:
    Webmaster
    Location:
    www
    looks like you used nulled theme or plugin
     
  10. Buy Twitter Followers

    Buy Twitter Followers Newbie

    Joined:
    Oct 27, 2016
    Messages:
    5
    Likes Received:
    0
    Gender:
    Male
    Occupation:
    London
    Location:
    United Kingdom
    i think this is a plugin script
     
  11. CrazyAnimal

    CrazyAnimal Junior Member

    Joined:
    Jun 2, 2014
    Messages:
    123
    Likes Received:
    26
    Occupation:
    Internet Marketer
    Location:
    Just around the corner!!


    YES, i am using nulled theme.


    Yes mate i already checked the .htacess, no malicious code.


    YES i am using Visual Composer.


    Mate, i found this code in pages only.


     
  12. Unfodos

    Unfodos Junior Member

    Joined:
    Mar 10, 2014
    Messages:
    180
    Likes Received:
    77
    Gender:
    Male
    Occupation:
    Webmaster
    Location:
    www
    send me the link i will help you
     
  13. aqibarif74

    aqibarif74 Jr. VIP Jr. VIP

    Joined:
    Jan 20, 2013
    Messages:
    2,340
    Likes Received:
    535
    Home Page:
    Contact your hosting provider.
     
  14. Unfodos

    Unfodos Junior Member

    Joined:
    Mar 10, 2014
    Messages:
    180
    Likes Received:
    77
    Gender:
    Male
    Occupation:
    Webmaster
    Location:
    www
    they can't provide any support because he use a nulled theme
     
  15. aqibarif74

    aqibarif74 Jr. VIP Jr. VIP

    Joined:
    Jan 20, 2013
    Messages:
    2,340
    Likes Received:
    535
    Home Page:
    can help him to restore 1 day older backup. OP send me your effected URL. I can help you with sort it out too without restoring older backup.
     
    • Thanks Thanks x 1
  16. Unfodos

    Unfodos Junior Member

    Joined:
    Mar 10, 2014
    Messages:
    180
    Likes Received:
    77
    Gender:
    Male
    Occupation:
    Webmaster
    Location:
    www
    i think OP want to remove the encrypted redirect script from the nulled theme .
    if he want get rid of this problem he just simply remove the theme ^^
     
    • Thanks Thanks x 1
  17. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,035
    Likes Received:
    38,818
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    And this is why you are fucked. Remove the theme, install default wordpress theme then run a wordfence scan.

    Once you site is clean then add a NON Nulled theme, if you use nulled themes on money sites then you are asking for trouble.
     
    • Thanks Thanks x 1
  18. CrazyAnimal

    CrazyAnimal Junior Member

    Joined:
    Jun 2, 2014
    Messages:
    123
    Likes Received:
    26
    Occupation:
    Internet Marketer
    Location:
    Just around the corner!!

    I have already contacted the hosting provider regarding this issue. They said that, "From our end all works fine, better you check with your code".


    Exactly said. You are 100% right.


    Thanks for your support mate. I have restore the default wordpress theme & customize it. Since it tooks me around 3 to 4 hours. Now it works fine.


    I can't find the redirect script from the nulled theme, so i have replaced with the default wordpress. Now it works fine.


    I completely agree with you mate. I removed the nulled theme and install the default wordpress & customize accordingly. Now it works fine and also i have restored all the plugins. Almost done..

    Thanks for your Support..