I just received a second email from Google Search Console, that one of my websites, Emma&Nala Jewelry was hacked. In the email, they have sent two URL's that they found to be "suspicious":

  1. http://emmaandnala.com/jlyesvgliktwgsg-b899-n26339-gslk/
  2. http://emmaandnala.com/n34104-kfkou-b890-xxptoayz/

The website config stats:

  • Linux Hosting at Avalon hosting, Business package
  • Wordpress 4.8, updated before this posting
  • Plugins:
    • Akismet v3.3.3
    • Contact Form 7 v4.8.1
    • Envato WordPress Toolkit v1.7.3
    • Google Analytics by Yoast v6.2.0
    • Hello Dolly v1.6
    • Instagram feed v1.4.9
    • Instagrate to WordPress v1.2.7
    • Mailchimp for WordPress Lite v4.1.5
    • NextGEN Gallery by Photocrati v2.2.10
    • Post Duplicator v2.20
    • Regenerate thumbnails v2.2.6
    • RevolutionSLider v4.1.4
    • Simply Instagram v1.3.3
    • WooCommerce v3.1.1
      • Woocommerce Category Best Seller Widget v1.0
      • WooCommerce Google Analytics Integration v1.4.3
      • WooCommerce Header Category Image v1.0.0
    • WooDojo v1.5.4
    • WordPress Importer v0.6.3
    • WordpressSEO by Yoast v5.1
    • WP Retina2x v5.0.5
    • WPBakery Visual Composer v4.3.4

Events timeline:

  1. 12th July 2017 I receive email from Google Search Console team that someone else was added as admin of Search Console property for that website
  2. I log into search console, remove these individuals (silly gmail account)
  3. I removed the verification .html file from the site root dir. as well, and re-verified myself as an admin (re-added the property)
  4. this morning, 27th July 2017 I receive email from Google again, listing the two above URL's as malicious

What I did:

  • checked web server file-system for any suspicious files/folders -> nothing there
  • updated WordPress to 4.8
  • updated plugins
  • removed all WP users except myself (admin)

Before I start messing up with wp.config and similar, is there anything else I can do? Skills level: self-taught newbie in unix, .js, python and a bit of sql flavors out there.

Many thanks for help!

EDIT 1: Here are the results of the WordFence scan if anybody would like to take a closer look :)

Wordfence scan results in a GoogleDocs file

closed as off-topic by Rarst, Jack Johansson, cjbj, Howdy_McGee Aug 18 '17 at 3:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – Rarst, Jack Johansson, cjbj, Howdy_McGee
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Unfortunately this sounds like you have an actively exploited hole somewhere. Do not rely on random internet advice for this, you need someone with security expertise scrubbing the site. At the very least try to get your hosting security team involved. Without knowing what the issue is and closing it your only option is probably a full rebuild and getting rid of any less than very established plugin. – Rarst Jul 27 '17 at 9:58
  • 2
    I bet your website was hacked through Revolution Slider. That plugin has more security gaps than I have hair on my head. – Jack Johansson Jul 27 '17 at 9:58

1st - Scan and identified malwares using this free tool https://sitecheck.sucuri.net if gives you files infected just delete them from your build.

2nd - Install sucuri plugin on your website and run again.

3rd - Change passwords on the admin users

4rd - Check for exploits on plugins on this site - https://www.exploit-db.com/

5th - Install Wordfence Security plugin

6th - Update urgently RevolutionSLider to the latest version

  • Hi, thanks for the reply. Here's a screenshot of what Sucuri plug-in says (I can't make any sense of this) Here a Screenshot – Alex Starbuck Jul 27 '17 at 13:56
  • 1
    @AlexStarbuck install the plugin Sucuri and run the scan through the plugin and let me know how it goes – Nuno Sarmento Jul 27 '17 at 18:02
  • I did that ;), check out my comment above yours, it says "Here is a Screenshot". Click on this and you will see a screenshot of my WP admin > Sucuri and the results. It found some core WP files as modified but it doesnt let me do anything with these. What should I do? – Alex Starbuck Jul 28 '17 at 9:40
  • @AlexStarbuck you should replace those files, and than apply file & folder permission through your cPanel – Nuno Sarmento Jul 28 '17 at 11:13
  • Nuno, here are the results of the WordFence plugin scan. WordFence virus scan results – Alex Starbuck Jul 28 '17 at 12:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.