1

An old client site was hacked.

After deleting the old site and rebuilding a new site, the Google Search Console has quite a few (50 or so) URL not found with this address pattern.

/category/business/%3C?php%20bloginfo('rss2_url');%20?%3E

I understand that it may reference the default rss function in WordPress, but some of the characters seem suspicious. Are these addresses that are standard to WordPress? Are these addresses possible caused by the compromised code? If so, what are the indicators?

  • It looks like someone’s tried to use a php function where php isn’t allowed in a link somewhere. – Jacob Peattie Jul 11 '18 at 0:17
  • That is my suspicion, but I don't know enough about the rss functionality to be sure. – Nora McDougall-Collins Jul 11 '18 at 0:18
  • The RSS functionality is irrelevant. This is a mistake. You’re just looking for some attempt at adding a link with PHP on the site. Does the error message include a line number or anything? – Jacob Peattie Jul 11 '18 at 0:22
1

It's not a standar URL for sure. That kind of URLs are most likely due to the compromised code, so there is no need to do anything with then but remove every trace it left.

Since the site is clean now, you should just remove those URLs from the Google Search Console.

  1. Log into the Google Search Console and select the desired website
  2. Click on Google Index in the left-hand navigation
  3. Click on Remove URL in the sub-menu
  4. Click on the button Temporarily Hide on this page

enter image description here

You will now be asked to type in the URL of the page that you want to be removed and confirm your choice by clicking on continue.

enter image description here

Done. Now you have to wait some time until the desired URL is removed from Google’s index.

  • This is good information and I feel it will help someone who comes to this question who is unfamiliar with Google Search Console! But in this case, I am wondering whether these addresses are produced by WordPress or possibly by the compromised code. I have added to my question to be more clear. My purpose is to decide whether to do redirects on them, as the client has simplified the site in the rebuild. – Nora McDougall-Collins Jul 11 '18 at 0:17
  • It's most likely due to the compromised code, there is no need to do anything with that but remove every trace of that. – Castiblanco Jul 11 '18 at 0:19
  • If you can add that to your response, I can check it as the answer! – Nora McDougall-Collins Jul 11 '18 at 0:20
3

This part of the request (URL)

%3C?php%20bloginfo('rss2_url');%20?%3E

is an attempt to put PHP code in a URL; it's the equivalent of

<?php bloginfo('rss2_url'); >

It may be that some hacker code in a compromised page is built to take the query parameters of the page and try to execute that code for some purpose.

As long as you have: completely rebuilt the site (from scratch?), but also reinstalled all themes and plugins from reliable sources, and then looked at any other files in the site folders (even if they are 'outside' of the rebuilt site), and also changed all credentials (hosting, ftp, users, etc) ensuring strong passwords, and inspected all customized code for traces of hacker code, and rebuilt your sitemap, you can remove those pages from search results using the technique in the other answer.

But, be aware that there are other search engines besides the Google, so you will need to check them also. An updated sitemap will help with that, although it may take some time to get fully 'clean' search results on all search engines.

  • You're right about what's happened, but I wouldn't assume hackers at this stage. If I had to guess an admin has tried to use the PHP tag to create a link to their RSS feed in a menu or something, not understanding when, where and how PHP is supposed to be used. – Jacob Peattie Jul 11 '18 at 0:41
  • @JacobPeattie; you are correct. Hadn't thought about that possibility. I'd be interested in how the OP figured out the site was hacked, though - it was that statement from the OP as to why I thought a hack.I had a site hacked via xmlrpc.prg (see my answer to wordpress.stackexchange.com/questions/308070/… for why I suspect xmlrpc.prg ). – Rick Hellewell Jul 11 '18 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.