Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I don't really know how to express my problem, so bear with me. This is a bit hard to explain.

I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-admin/install.php file. Asking for my login credentials of course. I have tried reinstalling WordPress and still have not been able to figure what they are doing.

That happens regularly. Also, a few hours later, I am able to see my site normally. Hope this makes sense.

I suspect there myst be some database DoS that allows them to inject a redirect of some sort into my admin area, thus redirecting the user to said directory (install.php). But that's just me. I really have no clue what else could they be doing.

I looked at the source code from several php files and noted some of them don't include a ?> tag. Could that be an issue?

My hosting company is iPage, I've contacted them and they say there's nothing wrong with my files. Anyone have a clue? I can paste the code to any source file.

share|improve this question
    
Did you attempt to upgrade WordPress or plugins prior to noticing this behavior? –  JCL1178 Mar 26 at 1:38
    
This behavior has been around for months. Since it's a new domain, I didn't noticed that was happening until weeks later. At this point I don't know if that happened prior to any Wordpress updates. But I believe so, because I only noticed it weeks later, the site would go "down" for a couple hours and then came back by itself. I just wasn't aware. –  saul Mar 26 at 3:22
    
Have you seen this question? There are some answers there that sound like they would be worth checking. (And if they do solve your problem, feel free to come back here and answer your own question with the solution – it might be helpful to others in the future.) –  Nick Mar 26 at 9:24
    
Does the redirect occur only when going to the admin login page, or when accessing any page in the public part of the site as well? –  nathangiesbrecht Mar 26 at 15:52
    
It's really hard to say what's going on. I basically uploaded a blank htaccess file to my Admin folder and installed Wordfence Security plugin. Although the site has been running "without" problems for the past few days. One day, while I was logged into the dashboard, the site again redirected me to the install.php. It used to happen several times a day, so I'm sure either the htaccess file of the plugin have had some effect. We'll see how it behaves the next few days. –  saul Mar 31 at 3:00

2 Answers 2

I would upload a fresh copy of WordPress excluding the wp-content folder. Update the core files. Then check your htaccess is correct. It's likely the installation didn't complete. Does iPage have any server side caching which you can manually clear?

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
share|improve this answer

Hi to be honest to the best of my knowledge the most common WP hacks are either weak PW security that has been compromised and allowed malicious code / updates to be made (consider the number of WP admins that didnt change the default UN 'wp-admin' thats already half of the auth guessed). Or for historic installs / ones with the offending versions bad versions of PHP thumb of (that used to have a well knowen exploit).

If your site is redirecting at all it would indicate that it has been compromised already and depending upon the method you are using to update it the malicious files (or DB entries) might not be getting touched / deleted.

However there are a bunch of 'remedies' on good old Google but also as with most things WP there are a bunch of plugins that can detect for common compromises. If you can still access your manager it may well be worth trying one of these as a starter..

http://wordpress.org/plugins/gotmls/

Good luck!

share|improve this answer
    
Thanks, I installed and scanned using gotmls. It did found some vulnerabilities, but they go beyond the scope of my expertise. I was specially suspicious about these files: .../tumblr/wp-includes/js/json2.js .../tumblr/wp-includes/js/jquery/jquery.schedule.js .../tumblr/wp-includes/js/swfupload/swfupload.js But then I have another domain and these same files were included as potential threats too. –  saul Mar 26 at 4:57
    
Hi also dont forget that if someone does manage to get write access to you web files they can update existing scripts that appear legit. As an after thought if you have been compromised other people will almost certainly have been too. Next time your site is redirecting get the URL it redirects too and try googling "wordpress redirects to xxxxxx.com domain" and see if you get some suggestions like that maybe? Again good luck. –  megasteve4 Mar 26 at 10:39
1  
Also to whoever down voted my answer - fair enough if you disagree with what I am saying but then maybe take the time to explain why and share you views for the benefit of others rather than just blindly down voting. –  megasteve4 Mar 26 at 10:41
    
Just went into my logs stats file. I found a log that seems suspicious. I don't fully understand the structure but apparently it calls for a GET function on wp-admin/install.php, which is where the redirect is happening. Here's the link to that GitHub: github.com/feedjira/feedjira/tree/master Any thoughts highly appreciated. –  saul May 27 at 20:43
    
Are you parsing RSS Feeds? –  eyoung100 May 28 at 22:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.