2

My Wordpress site (on a shared server) was compromised. It's full of spam links when I do a google site: check.

I removed a re-direct through cpanel so at least now the spam pages do not re-direct anymore. The re-direct had a name that was similar to a line in my htaccess file:

RewriteRule ^neabsmoiea.md$ "https\:\/\/post.ristourne.co\/Paket_ch\/" [R=301,L] ~ 

I assume this means the htaccess file was compromised as well? My site's name is in no way related to the words "neabsmoiea" or "ristourne" if that is relevant.

Naturally I changed all passwords, but I have no idea how to fix this.

3

Looks similar to a search redirect. You'll see the results when all of your search results go to someplace else.

Lots of ways for it to get in there. But, fix the htaccess. Get a standard one from WP here: https://wordpress.org/support/article/htaccess/.

Then, you should change all credentials: hosting, ftp, database, MySQL, and WP admin credentials. Look for unknown WP admin accounts (and extra FTP accounts). Check you wp-settings.php and wp-config.php. Look at the index file to ensure no extra code. Look at all files (via your hosting File Manager) to ensure no extra code. Look for hidden ICO files that contain code. Look at the wp-posts and wp-options tables for extra records that contain just numbers/characters.

Cleanup is hard - my process is here https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ . But even then that process is not perfect. I've got one client with a shared hosting and multiple WP and non-WP sites that keeps getting reinfected. And I've done all of the above stuff. Still haven't figured out where it's coming from.

| improve this answer | |
  • Thanks for your insights. – Martin B Nov 18 '19 at 16:25
  • I just checked re-directs in my cpanel, and the re-direct the spammer had set up has not re-appeared. So I guess that's at least a positive thing. The number of indexed junk pages in Google also dropped from 5000+ yesterday to around 800 today. Is it correct to assume that this means that the site is no longer malicious? When visiting the remaining spam urls it now shows "ERROR 404 - PAGE NOT FOUND" instead of re-directing. Am I correct to assume that this at least for now has stopped the problem? I realize I will have to fully clean the site as soon as possible-- – Martin B Nov 18 '19 at 16:28
  • 1
    If the search results are going to 404 pages, then the googles will eventually remove those search result entries. Takes a while, though. You can request removal of specific URLs through the google search console, but that takes quite a while to manually input each one. If you can't afford help, use the process from my blog (link in my answer). Do it again a few days later to see if things are still clean. Also update your sitemap.xml (resubmit to the googles) when you clean the site; that will help update search results (eventually). – Rick Hellewell Nov 18 '19 at 18:37
  • 1
    It will take a while (weeks) to get the bad search results removed. As long as the pages are coming up 404, then the googles/bings/ducks will notice and remove that search result. You might try creating a new sitemap.xml that is accurate, then submitting that via the Google Search Console (and there are sitexml plugins that will do that). That might be slightly faster in removing the bad search results. But don't expect this to go away quickly. As long as you have fixed the problem (and keep watching for it), this too shall pass. – Rick Hellewell Nov 21 '19 at 17:45
  • 1
    Glad you got the site clean; happy to have helped out (and can help out further if needed). That site redirect hack is a bit easy to clean (I've done it for another client). But others are a bit more difficult. Always fun, though ! (A 'checkmark' is always appreciated on answers that help with the problem, BTW.) – Rick Hellewell Nov 23 '19 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.