my wordpress website sometimes redirect to another website like "bigbricks.org" "greatbonushere.top" does anyone here have same problem with me before? how to fix or remove it? I already delete all index.php on Upload folder, also has checked the htaccess, DNS, and config files.
-
1Did you (try to) find others with the same problem. Like, for example: How To Clean The Malware Infected & Hacked WordPress Websites?, Tips for finding SPAM links injected into the_content– LuukCommented Dec 29, 2023 at 15:11
-
Finally, did you try: Updating Wordpress ?– LuukCommented Dec 29, 2023 at 15:11
-
Also see the WordPress article on what to do if you've been hacked.– Pat JCommented Dec 30, 2023 at 1:11
-
yes already tried that. the forum, the web, and updating wp.. but still no luck before. but no worry, I found it on network section on inspect element– Cross VanderCommented Jan 2 at 16:06
Add a comment
|
3 Answers
Your site has been compromised (hacked). There are tons of posts and articles on how to de-hack a site. It can be done, but is very time-consuming.
At very least, update/reinstall everything (WordPress, Themes, plugins), change passwords for database and all admin users, remove any unknown admin users, look for extra php files (in every single folder on your site).
You might try the free WordFence plugin to scan your site and look for hacked files (delete them).
Assume that you'll spend at least 20 hours in fixing/removing things.
answered Dec 30, 2023 at 0:30
-
the malware is not detected by any anti malware plugin, even an online scanner. but np, found the culprit after check the network when inspect element Commented Jan 2 at 16:04
Check your footer file for eval( statements. Maybe you will get lucky and find the hacker code. Normally you will not see the domains it is redirecting to, all that will be obfuscated and the hacker code will use eval() to run it. If you see eval somewhere in your files with a long string of weird looking characters that might be it. If your site is small then start over and rebuild it from scratch and keep the plugins, wordpress and themes updated.
answered Dec 30, 2023 at 1:12
-
1after i check the network in inspect element, search it one by one, I found the culprit Commented Jan 2 at 16:05
I go to inspect element and go to the network tab. Doing a full refresh, I found the website on a plugin (smooth scroll js). I remove that plugin and install it back. Now it is normal. If any people here have some problem with me, the plugin will not always be the same (depending on the hacker). Just look at it in the network tab, and then you will see the code is injected on what js file.