Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

About web sites before and after a security breach. If you need this tag your question is probably off topic.

0
votes
0answers
21 views

How would a hacker use this: /2011/09/%3C?php%20bloginfo('comments_rss2_url');%20?%3E [on hold]

Some months ago, a former client came to me with a hacked website. The site had not been maintained for 2 - 3 years. In the rush to rebuild the site, I didn't take the time to tear down the compromise,...
-1
votes
1answer
84 views

WP Site Hacked, Serp Google Spam [closed]

It all began when Google Ads suspended my ads because they found a malware in my WP site. I tried to do scan with some free plugins: Wordefence, anti-malware and Securi, or online tool like: sitecheck....
1
vote
2answers
28 views

Unfamiliar query string in Google Search Console URL not found

An old client site was hacked. After deleting the old site and rebuilding a new site, the Google Search Console has quite a few (50 or so) URL not found with this address pattern. /category/...
1
vote
0answers
27 views

How can I find security hole in my wordpress site?

Last day I've noticed that my site is hacked and a PHP backdoor is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not upload it myself. It ...
0
votes
2answers
85 views

What does this code do? (Injected code hacked)

This code below was been injected in my wordpress theme on functions.php Can someone explain me what does the code do? how that was been done? $div_code_name = "wp_vcd"; $funcfile = __FILE__; if(...
0
votes
1answer
129 views

malware in wordpress installer on dreamhost. <link rel='dns-prefetch' href='//coinhive.com' /> [closed]

I was trying to create a website. It is live. And you can see that there is a malware which google detected. In the source you will see three lines <link rel='dns-prefetch' href='//coinhive.com'...
-1
votes
1answer
24 views

How to remove content from hacked pages? [closed]

My WordPress/Woocommerce website was hacked and I ended up with a video category as well as urls to dead internal video links on the admin user's profile page. (I have attached an image of the user ...
1
vote
2answers
97 views

Strange gibberish JavaScript in Editor – site hacked?

A client's website runs on the theme 'enfold' which features the "Enfold Advanced Layout Editor". Currently that editor is broken – probably due to old version vs php or something. Anyways – trying to ...
0
votes
1answer
29 views

Where I can find a list of Wordpress security risks?

I'm working on one project where I need to find a list of different security risks or malicious codes which were used by hackers nowadays or in past. I can go and search one by one, but it will take ...
0
votes
1answer
92 views

wp-config.php modified?

This might be a broad topic but I am searching and reading but not able to clear my doubts, please advice in answer or links from where I can understand about how codes are injected to WP by attackers....
1
vote
0answers
30 views

Hacked site. Fixed. Nailing down the cause [duplicate]

One of the sites I manage was hacked, basically the hack consisted in redirecting users to other external webpage (sort of advertising spam malware). I have moved the hacked site to a staging site ...
0
votes
4answers
3k views

My Wordpress website was hacked

Today while working, I had tried to install Go Pricing Plugin from this website. https://www.downloadfreethemes.download/go-pricing-v3-3-8-wordpress-responsive-pricing-tables/ It was unsuccessful at ...
0
votes
1answer
92 views

Replacing nav-menus.php file with standard clean one?

I am a self-taught wordpress website designer so pardon my possible ignorance. A few sites I had worked on for a client were recently defaced by an Indonesian hacker group (fun!). The client had not ...
0
votes
3answers
836 views

Increased CPU load due to admin-ajax.php spam

I experienced that my server received a 99% CPU load and the site goes almost down. Checked the access log file and there are tons of following entries: 203.115.XXX.XXX - - [13/Oct/2017:12:40:01 +...
0
votes
1answer
27 views

Find and Replace text in the entire table using a MySQL query

Website has been hacked and they have injected javascript into every single post, page and product (woocommerce) - Editing every page manually would take for ever, we have over 3000 posts. Is there a ...
0
votes
1answer
47 views

Can't access htaccess [closed]

my htaccess have chmod 444 and it's not possible for me as admin with ftp access to edit it. Also if I'm disabling all wp security plugins. When I'm change the chmod to 644 or if I just remove the ...
0
votes
3answers
63 views

how to find the way they hacked my WP site

Last night, one of my clients' sites was hacked. The only thing that's been done by the hackers, as far as I can see, it that they changed the content of the index.php file to theirs. The fix for ...
1
vote
0answers
45 views

How can I safely hide the fact that my website runs on Wordpress? [closed]

I would like to hide the fact that my website runs on Wordpress from potential hackers. Is there a reliable plugin that I can use, or an online guide to doing this, so that a website visitor would ...
-2
votes
1answer
50 views

My site appears to be hacked [closed]

My site appears to be hacked. When I log on to the control panel http://www.elqanah-news.com/wp-login.php it gives redirects
2
votes
1answer
102 views

Hacked WordPress website, as notified by Google Search Console, what to do? [closed]

I just received a second email from Google Search Console, that one of my websites, Emma&Nala Jewelry was hacked. In the email, they have sent two URL's that they found to be "suspicious": http://...
1
vote
3answers
130 views

getting casino links on my woocommerce site [closed]

i am getting various casino links on my site, i have searched everywhere in the files in my database, but i can't locate the issue, these links come and go they mostly appear in the header and the ...
-1
votes
1answer
504 views

How to stop repeated hack on header.php of custom theme? [closed]

Noticed some unwanted files on the website root folder and removed them. I have found that header.php file has some malicious code which redirects to spam sites only on mobile browsers. when these ...
0
votes
1answer
33 views

Replace domain in database

My site is attacked, so basically all the core php files are corrupted and broken. Only the database is left. Now I tried in my localhost. If I want to restore my site from this database, is domain ...
-1
votes
1answer
1k views

How to locate & delete hidden pages on a site

Basically my friend has a custom wordpress site which was hacked recently but apparently the dev cleaned it up (said it was a server hack and that all their sites were hit) and filed a reconsideration ...
0
votes
1answer
3k views

looking for indoxploit hack solution [closed]

On our WordPress powered website we have only 1 user: ID: 1 username: is not admin WordPress working with latest version, theme and plugins are all updated to the latest. username and password is ...
0
votes
0answers
114 views

Hacked Wordpress website /Homepage redirect

I am very sorry about the length of the post, please bear with me as I am going to try and list everything I've done so far. I am dealing with a hacked WordPress site which had been left without ...
8
votes
5answers
2k views

WordPress site hacked. Has .htaccess been hacked?

I'm trying to clean up a WordPress website that's been hacked. I noticed that the .htaccess file has some suspect looking regular expressions, but my regex skills are pretty weak (time to learn I ...
0
votes
1answer
46 views

Admin user lacks admin permissions after hack and can't reinstate

My site (4.5.3 on Apache/Linux) was hacked, I suspect something like the one described here. As best I can tell I've removed or at least disabled the hack, however admin users aren't able to perform ...
1
vote
1answer
52 views

Wordpress Footer Missing After Website Hack

My wordpress website has been hacked, once recovered i can't seem to view the footer. I have checked the theme options / widgets and the settings seems fine. Kindly advise on possible causes and ...
1
vote
0answers
126 views

wp-admin folder removed by hacker [closed]

My website got hacked recently & i can't login into the admin panel, the hacker removed wp-admin folder in root. Now when i try to login, i get too many redirect errors.
0
votes
3answers
5k views

How to find the backdoor of the hack

Today one of our clients' WordPress sites was hacked which is hosted with amazon aws ubuntu. Issue is https://blog.sucuri.net/2016/01/jquery-pastebin-replacement.html The js code is injected in all ...
0
votes
1answer
43 views

Is the current spate of hacks related to the recent security fix?

There has been a rash of hacks over the last week. In each case the content of the post has been edited with either an infantile "hacked by" or a political message. This post https://codex.wordpress....
0
votes
1answer
129 views

Why functions.php file automatically empty in my wordpress websites?

In many wordpress websites functions.php file automatically erased. I check every file. scanned files on server but no file is infected. After a interval of time website response white page, when i ...
2
votes
2answers
401 views

How to prevent bot or someone to modify any file automatically?

Someone modifying daily our website file wp-blog-header.php. They are adding below code which generates unneceassy pages automatic in our website, Code is : $e = pathinfo($f = strtok($p = @$_SERVER["...
1
vote
3answers
48 views

If a WP install is hacked, can it spread to other domains on a server?

I have a managed server with several WP and non-WP sites, and code has been prepended to the content of all files (for all domains on the sever) which begin with a php command. I'm wondering whether ...
2
votes
2answers
189 views

What should I do about hacked server?

My (managed) dedicated server, with several sites (not all of which use WP) has been hacked. Obfuscated code has been appended to all files (including WP core/plugin/theme and non-WP stuff) for which ...
0
votes
0answers
130 views

Some code is added automatically to my site's header - what is it?

I tried a lot to understand what adds the javascript code below to my site's header, right after <head> in my WordPress website. I don't have any plugin that would do that, it just appeared ...
1
vote
0answers
310 views

My Wordpress Websites are always under attack

I work with Wordpress since years and I use to protect my client websites with iTheme Security + Wordfence keeping core and plugins always updated and using only Themes or Plugin from secure markets. ...
0
votes
1answer
27 views

I have removed the malware from our website however, when I tried again to search the word from Google it is still there [closed]

I am not sure if this is the right page. But if not, please redirect the correct page. I have removed the malware from our website however, when I tried again to search the word from Google it is ...
0
votes
0answers
108 views

Deleted posts, can't recover

A group of friends and I started a website in April of 2016, and all was well. However, a few months later (at this time, it was roughly late July-early August I believe), we were hacked and all of ...
-2
votes
1answer
1k views

Malicious Code in Index.php Wordpress [closed]

I found always <?php header("Content-type: text/html; charset=utf-8"); @set_time_limit(0); $xmlname = 'mapss.xml'; $jdir = ''; $smuri = smrequest_uri(); if($smuri==''){ $smuri='/'; } $smuri = ...
-1
votes
1answer
2k views

My WP site and password was hacked, what to do? [closed]

Today I realized that my WordPress blog was hacked. I noticed, because the title was altered to something like: +ADw-/title+AD4-Hacked By *** +ADw-meta http-equiv+AD0AIg-refresh+ACI content+AD0AIg-5+...
1
vote
1answer
88 views

How to prevent wp-login brute force attack from thousand of different IP? [duplicate]

Investigating a problem. I found out that I had so many calls to wp-login, but from many different ip's. Any idea on how to handle it?
0
votes
1answer
98 views

Efficient way to check local Wordpress php files and Database for malicious code? [duplicate]

First of all, I am not a WP superuser. Recently a friend of mine got hacked, by hacked I mean he didn't update his WP for a long time and got malicious code injected which sent spam, so his hoster ...
1
vote
1answer
1k views

Files automatically added

Today I was warned by iTheme Security that were added 2 files: wp -content / uploads / GeoIP.dat wp / content / uploads / GeoIPv6.dat Where did these come from and what is their purpose?
0
votes
0answers
39 views

Can compromised theme files lead to WordPress core files being modified?

I was recently given a website that had been hacked before I took over maintenance for it. There was a script injected to the top of every core WordPress and theme PHP file. The first step was to ...
1
vote
0answers
115 views

What is this code in my theme's footer.php causing chmod permission warnings? [closed]

I am stumped on this and can't seem to fix the issue. I removed the code, that didn't work as it came back. I tried looking throughout my theme's files and can't see anything else. Does anyone have ...
2
votes
1answer
922 views

How do i disable/disallow <script> and <iframe> tags in TinyMCE?

A client of mine has just had 200 posts injected by malicious scripts and iframes. The website is now all cleared. They were put in the content by the user updating the post/page as my clients ...
1
vote
2answers
2k views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, it'...
0
votes
1answer
62 views

Website Got Hacked - Fixed - Now Cannot Activate Theme

My wordpress site got hacked, I fixed the problem but had to delete the TwentyFifteen theme (the one that was hacked). The theme I was originally using was different, but the hackers hacked the ...