Forum Moderators: Robert Charlton & goodroi
The site is a wordpress blog. How can I get rid of this text? It appears on every page.
I can only resubmit for inclusion after gettiong rid of this text. I have very limited coding knowledge. Also, what can i do to prevent this from heppening in the future.
I should have made a backup in the last few days so I could have restored to a previous state before this happened, but my last backup was probably weeks ago since when I have added lot of content.
By the way, its a quality site and there is no way I would cheat myself by spamming it with hidden text because the site makes me a bit of money from adsense and affiliate commission, not much but around $200 a month.
Thanks for any help and suggestions.
Also, is there anyway way of knowing who might be resposnible for this? I have a fairly good idea but don't want to accuse him unless I am 100% sure.
But I will address some of the Google aspects. A lot of information is already available here: How Hacked Servers Can Hurt Your Traffic [webmasterworld.com]
There is currently even more server hacking going on than ever before. To repair the damage, you need to do more than delete the injected code from the pages. You need to make sure you are running the most up-to-date version of WordPress. When a way to hack any version is discovered, the news spreads quickly through the spam-and-scam world.
If you don't keep the software updated, then someone will be hacking you again. Let Google know that you've updated the software in your reconsideration request - that's a help, and it's something that they look for.
My site is in fact running on an older Worpress admin, so the first thing I suppose I must do is install the latest one.
Thanks
The only problem is that this time (unlike the last) Google took me off the search results only hours after sending me an email. I think they ought to give people couple of days at least for them to try and and sort it out. I think this is a little unfair on genuinley hardworking webmasters who have to suffer through other peoples stupidity.
Anyway, I think I am going to move the site to my main host as well because, like someone said earlier, there may be a fault with my host who possibly have a loophole that the guilty party was able to take advantage of.
Again, thanks for helpful suggestions guys.
Or, would it be impossible to know unless someone checked first.
Mack.
1. Upgrade to the latest version of wordpress
2. Go into myPHPAdmin and delete all spam comments from the database. Even if you have no experience using myPHPAdmin (or similar) you should be able to do this pretty easily by searching for instructions online.
3. Go into webmastertools and let Google know what happened and that you have elminated all spam from the site.
Basically, you have to go into the database to eliminate the spam from the site. It is not present in theme files (such as footer.php) but is in comment form.
Basically, you have to go into the database to eliminate the spam from the site. It is not present in theme files (such as footer.php) but is in comment form.
Perhaps there could be additional spam in the comments. However, from the description of the problem:
The hidden text appears on all the pages right at the bottom (the same text) when I view the source code of the pages.
Then I would suspect the footer.php
SQL Injection, if it succeeds, replaces the content of all SQL record fields it can get at. I'm not saying that's the case here (it doesn't sound like SQLI), just that it's possible.
If no offending text is found in footer.php then inserting some debug text at the start of footer.php and end of footer.php will show if the offending text is in between these or before/after these and then follow up functions called and narrow the things down.
I just wanted to point OP to what I believe would be the correct starting point in finding his hidden text.
I actually removed the files from the index.php file through the cPanel, but it looks like they would have been in the footer file as well. I am going to upgrade to current Wordpress, but is there a way to put a piece of code that would block someone from entering hidden links even though the links might be infected by the way of spam comments.
Make sure your own PC doesn't have a virus.
There are virus today that use FTP from your own PC to update your sites.
EXACTLY what happened to my bro's computer. I have about 12 sites on my server and, of course his two, sure enough that fake antispyware sniffed his FTP and hacked it to show in .html files and such. I was a loooong line of JavaScript and I found out it would go to a site that would put that on other's computers. What a mess. It took me over a day to fix the files and get the crap off. Caught it in time to not get hit by Google.
I changed the passwords for his FTP and told him not to keep it on his computer anymore as he hasn't learned how to be safe yet. Thank GOD he didn't have FTP to some of my other sites! PHEW.
How it "sniffed" out his FTP passwords IDK. They were very strong passwords too! Those people really piss me off...
Also check that the FTP server does not have any exploits listed for it. One well-known one did a few years ago.
