The site I've been working on,
International Times [internationaltimes.it], has evidently been compromised - if you google "site:internationaltimes.it viagra" you'll see there are many pages that obviously shouldn't be there.
However, everything seems normal if you go to the front page and navigate from there. In fact, even copying one of the links from the search results and pasting it into the address bar doesn't take you to the spam drug-selling site, though following the same link from search results will. I don't know quite how that works.
In fact, I don't know how any of this works! When I've seen sites compromised before, I've always been able to spot something dodgy in the php files (and sometimes also elsewhere) but in this case, all the spam links are actually to archive files which have since moved into their own archive directory, so in principle they should be showing Nothing Found (well, they SHOULD be redirecting to the new location, actually, but I haven't done that - that's a question for another thread)... I can't spot anything out of place either in the archive code or the WordPress code on the new site, or in .htaccess for that matter.
So at what level could this hack have occurred? What am I missing?
Many thanks for any help...
