My Wordpress site (on a shared server) was compromised. It's full of spam links when I do a google site: check.

I removed a re-direct through cpanel so at least now the spam pages do not re-direct anymore. The re-direct had a name that was similar to a line in my htaccess file:

RewriteRule ^neabsmoiea.md$ "https\:\/\/post.ristourne.co\/Paket_ch\/" [R=301,L] ~ 

I assume this means the htaccess file was compromised as well? My site's name is in no way related to the words "neabsmoiea" or "ristourne" if that is relevant.

Naturally I changed all passwords, but I have no idea how to fix this.

1 Answer 1


Looks similar to a search redirect. You'll see the results when all of your search results go to someplace else.

Lots of ways for it to get in there. But, fix the htaccess. Get a standard one from WP here: https://wordpress.org/support/article/htaccess/.

Then, you should change all credentials: hosting, ftp, database, MySQL, and WP admin credentials. Look for unknown WP admin accounts (and extra FTP accounts). Check you wp-settings.php and wp-config.php. Look at the index file to ensure no extra code. Look at all files (via your hosting File Manager) to ensure no extra code. Look for hidden ICO files that contain code. Look at the wp-posts and wp-options tables for extra records that contain just numbers/characters.

Cleanup is hard - my process is here https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ . But even then that process is not perfect. I've got one client with a shared hosting and multiple WP and non-WP sites that keeps getting reinfected. And I've done all of the above stuff. Still haven't figured out where it's coming from.

  • Thanks for your insights.
    – Martin B
    Nov 18, 2019 at 16:25
  • I just checked re-directs in my cpanel, and the re-direct the spammer had set up has not re-appeared. So I guess that's at least a positive thing. The number of indexed junk pages in Google also dropped from 5000+ yesterday to around 800 today. Is it correct to assume that this means that the site is no longer malicious? When visiting the remaining spam urls it now shows "ERROR 404 - PAGE NOT FOUND" instead of re-directing. Am I correct to assume that this at least for now has stopped the problem? I realize I will have to fully clean the site as soon as possible--
    – Martin B
    Nov 18, 2019 at 16:28
  • 1
    If the search results are going to 404 pages, then the googles will eventually remove those search result entries. Takes a while, though. You can request removal of specific URLs through the google search console, but that takes quite a while to manually input each one. If you can't afford help, use the process from my blog (link in my answer). Do it again a few days later to see if things are still clean. Also update your sitemap.xml (resubmit to the googles) when you clean the site; that will help update search results (eventually). Nov 18, 2019 at 18:37
  • 1
    It will take a while (weeks) to get the bad search results removed. As long as the pages are coming up 404, then the googles/bings/ducks will notice and remove that search result. You might try creating a new sitemap.xml that is accurate, then submitting that via the Google Search Console (and there are sitexml plugins that will do that). That might be slightly faster in removing the bad search results. But don't expect this to go away quickly. As long as you have fixed the problem (and keep watching for it), this too shall pass. Nov 21, 2019 at 17:45
  • 1
    Glad you got the site clean; happy to have helped out (and can help out further if needed). That site redirect hack is a bit easy to clean (I've done it for another client). But others are a bit more difficult. Always fun, though ! (A 'checkmark' is always appreciated on answers that help with the problem, BTW.) Nov 23, 2019 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.