Wordpress Website redirection virus attack?

MemeLord

MemeLord

Junior Member
Joined
Jan 25, 2022
Messages
168
Reaction score
100
My 2 year old website suddenly started to redirect to some suspicious cpa/allow notification alert type page.

I talked with support multiple times and they scanned for virus but no virus was found. They did restoration of previous backup to fix this issue but the fix is temporary. After 12-24 hours later, same redirection.

Ps : I didn’t installed any new plugin or theme recently. My password is strong alao 2step verification is on.


What should i do know?
Delete whole website or database and everything?
 
Advertise on BHW
Do you use any nulled/hacked plugins or themes?
It doesn't have to be recent, it coulda been lying dormant until they figured your site is worth taking over.
 
xReminisce said:
Do you use any nulled/hacked plugins or themes?
It doesn't have to be recent, it coulda been lying dormant until they figured your site is worth taking over.
Click to expand...
This, and if this isn't the case, have you considered that you might be the vulnerability? even logged in from unsafe PCs? Maybe you are actually giving away login info
 
xReminisce said:
Do you use any nulled/hacked plugins or themes?
It doesn't have to be recent, it coulda been lying dormant until they figured your site is worth taking over.
Click to expand...
yeah maybe but website was working fine with the nulled plugin for the last 2 years, this is all of a sudden but the fun fact is my other websites are also facing this redirecting problem. That website was fresh, no nulled plugin or hacked things.
SunnyLeon said:
This, and if this isn't the case, have you considered that you might be the vulnerability? even logged in from unsafe PCs? Maybe you are actually giving away login info
Click to expand...
Positive.
 
Restore from backup and start purging plugins you don't use, update everything else. It's probably an exploit that wasn't updated/caught yet. Eventually, you'll narrow it down. If your other websites are facing the same problem it actually makes this easier because you can cross-reference which sites are using the same plugins/themes and start from there.
 
If all your websites are on the same host, all will be infected.
Don't use nulled themes/plugins.
Even if the nulled plugin/theme is clean, it may have vulnerabilities; in this case, developers release an update to fix the vulnerability, but because you have a nulled version, you will not get any update.
Use the wordfence plugin and start scanning your website.
 
happens to me if you don't have a clean backup you will need to install everything from 0 next time avoid using nulled themes or plugins also setup a weekly backup
 
MemeLord said:
My 2 year old website suddenly started to redirect to some suspicious cpa/allow notification alert type page.

I talked with support multiple times and they scanned for virus but no virus was found. They did restoration of previous backup to fix this issue but the fix is temporary. After 12-24 hours later, same redirection.

Ps : I didn’t installed any new plugin or theme recently. My password is strong alao 2step verification is on.


What should i do know?
Delete whole website or database and everything?
Click to expand...
I'm facing the same problem. And now It's already fixed. tl;dr

To fix this you need to remove every malicious code in php files. Try sort by date all of the files in your public html. Find the most recent modified php files. Try to edit those files and look up the code. If theres strange code then ITs have indication that your web get infected.

Just delete the code, repeat the step for every PHP files with new modified time stamp. Sometimes the code inside plugin folder or theme. To fast the process use notepad++.

However, i don't know if your site and my site facing the same issue or not. But thats how i fix it.
 
We recommend using any high secured web hosting service.
 
1. You might be using nulled plugins/theme. Remove them or use paid or free plugins.
2. Please check and update all the existing plugins/theme.
3. Disable all the suspecious plugins and monitor for 24 hours.


If none of the above solves the problem, please check with any wordpress developer on upwork or here and you will definitely get a solution. Good luck.
 
Backdoors are really not detected by virus or malware scanners its complete manual work. If problem is not resolved you can ping your hosting providers to cross check with below things
1) File permissions
2) Mysql Remote access ( Disabled )
3) htaccess to block all on config files.

Good Luck :)
 
Definitely, this is by the nulled plugin from untrusted sources found online. It will infect all the wordpress sites in the same Cpanel. Take a backup of all the sites. Scan all your sites with wordfence and other security plugins. Mostly wordfence will find the malicious codes in every file. Remove those codes. Change your password to hard. Once the problem is solved, take a local backup immediately.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top