Google is showing "this site may be hacked", and search results include a few URLs with this kind of pattern of query string: ?lang=ja&k=1309zFKBIXxb6fWDQH0080

Nothing we can find is showing up any hack. We'd like to return a 404 for any URLs containing "lang=ja" (at least for now while we look into it further), so added this before the Wordpress section in .htaccess:

RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)lang=ja(&|$)
RewriteRule . /404.php [L,R=404]

It seems to be completely ignored, and we can't seem to get it to work, trying several slight variations. Can anyone tell us what we're doing wrong?

closed as off-topic by cjbj, Max Yudin, Mark Kaplun, Fayaz, bosco Apr 18 '17 at 19:49

This question appears to be off-topic. The users who voted to close gave these specific reasons:

If this question can be reworded to fit the rules in the help center, please edit the question.

I know you are asking about htaccess and rewrite rules, but, you are trying to hide your hacked condition from google, rather than finding the backdoor that's been installed, and the hacker is just going to change his method of putting spam pages on your site, you will get the "may have been" warning again, and it will be harder to get cleared by google.

And when the hacker has been alerted that you are taking action, he hides more files in your home directory somewhere, files that look innocent, but when a certain amount of time has passed they activate and there you are again.

If google says you are hacked, and you have the spam urls, you have to clean. find the infection, and harden the site.

You should have hardened the site already. Put an authentication on the wp-admin directory, run scanners delete the wp-includes and wp-admin, download the wp-content to your desktop, or in some other way store and protect it, and your wp-config and htaccess, then delete everything, wipe it all out, and reinstall clean.

Then go over the wp-content with aggression, because it's a very likely place for hidden files. If in doubt, any doubt at all, delete it and recreate or reinstall it.

And block PHP from running in the wp-content directory.

Etc etc.

Your htaccess approach wont work.

  • I get what you mean, but the intention is just to stop the effect of redirecting in the way the spammer wanted, just in case and as an extra, not to hide anything. All of that hardening has been/is being done, and we can't get the "lang=ja" URLs to actually redirect (they just show the home page). – CBC_G Apr 7 '17 at 15:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.