Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Our site may have been hacked.

It loads okay on desktop browsers, but on mobile devices it redirects to a porn site.

I can't see anything in the source code or .htaccess which would be causing this.

The site is Wordpress based, and it used to use Wordpress Mobile Edition, but that is now deleted, yet the symptom persists.

Can you see what is redirecting mobile visitors?

share|improve this question
1  
Not meaning to be rude, but have you contacted your hosting company? img407.imageshack.us/img407/626/20130312092853.png –  user 99572 is fine Mar 12 '13 at 8:28
1  
Yes I have contacted our hosting company. Waiting on a response. –  Steve Mar 12 '13 at 9:00
    
Hmm. Unless the entire machine has been hacked, this is likely to be somewhere in the Wordpress code. It might be worth downloading the full source and searching it or the offending domain name; also if you have access to phpMyAdmin, I'd do a quick search for the domain in all tables. It's possible that the domain name is encoded in some form that renders this simplistic approach useless but it'd be a worthwhile first step. –  Pekka 웃 Mar 12 '13 at 11:56
    
Ask your web host to make your .htaccess Read Only. A writable htaccess is a very poor managed site to honest, all files that don't need constant updating should be read only. i.e if you don't do many template edits then ask them to make the template also read only. Most hax are header.php, and htaccess injections on wordpress. Do not under estimate the power of chmod ;) –  bybe Mar 12 '13 at 19:17
    
Yeah they are read only already. I've moved hosting providers. About 6 of my websites got hacked with the last hosting provider - I'm not sure if it wasn't a hosting environment vulnerability instead of a website vulnerability. –  Steve Mar 13 '13 at 10:57

1 Answer 1

up vote 4 down vote accepted

It is a server side redirect. There is something in the code that is powering your website that is detecting a mobile user agent and is issuing a 302 redirect. Your site has been hacked. I can confirm this with the following command line command. I'm using a command line program called curl to download your website and setting the user agent to what an HTC Desire phone would use.

$ curl -s -D - -A 'Mozilla/5.0 (Linux; U; Android 2.1-update1; de-de; HTC Desire 1.19.161.5 Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17' http://www.louisbaxters.com.au/
HTTP/1.1 302 Found
Date: Tue, 12 Mar 2013 09:34:27 GMT
Server: Apache
Location: http://crzyluxtds.in/go.php?sid=1
Content-Length: 217
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://crzyluxtds.in/go.php?sid=1">here</a>.</p>
</body></html>

Here is a thread from other people that have this problem: http://wordpress.org/support/topic/problems-viewing-site-on-mobile-iphone-htaccess-related

They suggest removing the following lines from all .htaccess files. Even the .htaccess files hidden in directories:

RewriteRule ^(.*) http://crzyluxtds.in/go.php?sid=1 [L,R=302]

You should also delete the following files that may have been added:

wp-includes/pomo
wp-includes/pm.php

EDIT: Google launches new webmasters hacked page

If you haven't already either yourself or your web design administrator can run your site using Google's Webmaster Tools Hacked Page.

share|improve this answer
    
Something will be referring to them maybe in the SQL too. Since those standalone files must be called somehow, most likely in the header.php, made a edit to your question as Google just launched a new hacked website guide. –  bybe Mar 12 '13 at 22:56
    
Good edit, bybe. –  Stephen Ostermiller Mar 13 '13 at 0:20
    
I had searched the .htaccess file, but it wasn't there. When I searched all code in the site, crzyluxtds.in was found in .htaccess. They'd put a hundred blank lines between their entry and the normal wordpress entry, making it hard to see on casual inspection. Thanks for your help. –  Steve Mar 13 '13 at 0:44
    
Thanks for your efforts Stephen, you saved me a big headache. –  Steve Mar 13 '13 at 10:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.