WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my website www.saoyuying.com (the site is in Chinese :)) is included in Google's malware blacklist yesterday. But I didn't find any unusual files on the server. Google's report mentioned that

"Some of the URLs on this site redirect browsers to web pages that install malware. This indicates that the server(s) that host pages for this site may contain altered configuration files (such as Apache's .htaccess file)."

While my .htaccess content is copied below:

# BEGIN WPSuperCache
# END WPSuperCache

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

Is anything harmful here? Or what else should I check? I would really appreciate your help!

Thanks & Regards, Joe



Thanks to Dwayne's answer, the actions below have been taken:

I. Installed 3 security plug-ins in wordpress: Exploit Scanner, WP firewall 2, BulletProof Security.

Exploit Scanner scanned the website and found several 'eval' and 'base64_decode' like


I know it just means executing string content. But I was not able to find anything suspicous.

II. Sucuri SiteCheck. The result is here:

Sucuri SiteCheck on saoyuying.com

which says:

Malware found in the URL: http://www.saoyuying.com//404javascript.js

Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwht291 Location: http://namesti.bee.pl/

But I can't find this '404javascript.js' on the server, nor inside functions.php or index.php.

This js looks like the root cause as the URL 'namesti.bee.pl' is also mentioned in Google's warning.

But how to locate and get rid of it?

Thanks again in advance.

share|improve this question

closed as off topic by Chip Bennett, Brady Mar 1 '12 at 14:02

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Welcome to WPSE! Unfortunately, while I sympathize with what you're dealing with, questions about malware/hacks are explicitly out of the WPSE scope, as defined in our FAQ. – Chip Bennett Mar 1 '12 at 13:58

Redirection can happen in many different shapes or forms. Sometimes it is due to an injection into a page or sometimes pages. Usually a snippet of JavaScript or an iFrame is injected into a page which redirects a user when they load a page. The most common form of redirection hack is usually some kind of SQL injection.

I recently encountered a situation where every single PHP file on the site had been injected with some eval base64 code that redirected only users from search engines. So it would only redirect someone to a rogue malware site if they tried accessing your site from Google.

You're site isn't blacklisted permanently, once you sort the infection out then you can request a review and get the report removed. It can be quite involved salvaging a site and then strengthening it but luckily people have created plugins to help out.

There are various attacks that people are using these days to infect Wordpress sites. A simple thing of having too loose permissions on folders like your uploads or even wp-content folder are all it takes.

I've seen a crafty Wordpress hack where they add in about 30 or so blank lines of space into your .htaccess file to give the appearance of everything being alright when they put some redirect code at the bottom of it. This tricked me up a few months ago on a site that got hacked.

This article is rather long and might be an interesting read for you: http://www.esotech.org/resources/cms/wordpress/wordpress-header-javascript-and-iframe-injection-problem-solution-and-analysis - it offers a solution to the hack the author experienced which might not relate to you, but it is a somewhat informative read to help you understand these types of attacks.

Wordpress have a nifty guide up on their codex about steps to take when you think you've been hacked. It doesn't help with everything, but some nice informative steps to remember like changing passwords. Read it here. A quick search of this site will also produce some great resources to read and download when you've been attacked.

It sounds like you've encountered some form of injection attack to me. If you're not comfortable with manual changes to the database and files, you can install this plugin called Exploit Scanner which will scan your database and files for all kinds of malicious attacks like the common iframe injection hack.

A couple of useful plugins I recommend everyone install on their Wordpress sites are: WP Firewall 2 and Bulletproof Security. Bulletproof Security in my opinion is one of those must haves, it protects against CSRF attacks, base64 injection attacks and SQL injection attacks, plus more, it even adds rules to your .htaccess for securing your site further.

WP Firewall 2 inspects web requests and will stop them in their tracks, sending you an email letting you know the details. Sometimes the plugin can get confused, but I recently used this on a site that kept getting defaced by Egyptian hackers modifying pages and injecting HTML somehow and it stopped them.

share|improve this answer
thank you for your kind help. I'll read the articles. – Joe Mar 1 '12 at 9:57
No worries Joe. If you get stuck, let me know and I'll gladly help you out personally for free to get the site back up and running. I know what it's like to be new at using Wordpress and sorting these kinds of issues out. – Dwayne Charrington Mar 1 '12 at 10:45
Hi Dwayne, as updated in the question, I seemed to get some clue but wasn't able to locate the malware. Any suggestions please? Thanks in advance. – Joe Mar 2 '12 at 9:03

There is nothing out of the ordinary there, standard WP .htaccess file

share|improve this answer
This should be a comment. It doesn’t answer the question, does it? ;) – toscho Mar 1 '12 at 10:13
It answers "Is anything harmful here?" :P – Vince Pettit Mar 1 '12 at 10:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.