Tag Info

Hot answers tagged

10

Google does not just ignore links in sections that are display:none. Consider DHTML multi-level drop down menus. In such a menu, you hover over the top level menu item and a list of links drops down. That is a case in which the links are in display:none initially, but user interaction with the page shows them. Using drop down menus like this is ...


8

What to do (right now I am awaiting the restore of files from hosting provider)? Fix the holes that caused you to get hacked in the first place. If it was a result of the web host's neglect then find a new host. Keep backups of your site so you don't depend on your host for this. How to prevent this? If you write your own code you need to ...


7

FYI, this won't hurt your website from an SEO point of view. Unsolicited one way backlinks can never hurt you (if you purchase links those one way backlinks can hurt you). If they could then tactics like this would be an easy way to sabotage your competition. At worst, one way backlinks have no value. This is probably the case with the links you are ...


6

This kind of attack won't affect your rankings as bounce rate is almost certainly not a ranking factor. It's hard to say why this user is doing this but I doubt it's to manipulate your bounce rate or site stats. More likely reasons are: they are trying to attack your site through that page. that page being loaded somehow benefits them and thus they are ...


5

Start from Scratch If you have a recent database and files copy nuke all and start all over again. This is truly the best way there is when you have been hacked in a massive way. No Good Backups Most of the time there is no good backup in my experience. And I guess you do not either. If you did a scan with ClamAV and or online scans with sites like ...


5

This is almost certainly a robot. It is a common trick for robots to use simple heuristics to look for URLs within JavaScript strings. It's fairly simple for absolute URLs, but for relative URLs it can be hit and miss, in this case clearly more of a miss. The fact that the robot is not crawling with a user agent that identifies him may mean that it has ...


4

Your site currently has some malicious Javascript embedded in the bottom of your site that embeds an iframe in your page. This could infect visitors with malware, attempt to steal their passwords, or do all sorts of other nasty things. There are a couple of steps you can take to remedy this problem. Reinstall the latest version of WordPress It's very ...


4

In case you're curious, here's the source (or a copy of it) to the attacker's method: http://pastebin.com/yCW9vWzZ This may help also: http://www.wjunction.com/10-hosting-discussion/116021-boxslots-hacked-again-5.htm As for being worried? If you are sure you follow the orthodox server security protocols, and you actively check for and fix any holes, then ...


4

Goo.gl is a URL shortener. It just means someone linked to your website using it. Pu.gg is a torrent tracker. I don't know why you would get pageviews from them. You may be hacked and hosting a torrent file. You should get your site out and look for any suspicious files.


3

To answer your question about "how somebody can write new files into my hosts" there are three ways I've seen this happen. First, FTP account hijacking. The worst case I had to deal with on my sites is when a hacker gained access to either a root level or high level account that allowed them to overwrite the index pages of all of the sites on that shared ...


3

there currently aren't any safeguards in place, and while uncommon people can spam your account, for example, if they hold a grudge. If you are spammed you cannot remove this data. It is best to put in place a precautionary filter, selecting 'include only' and 'traffic from the domains' and setting this to your domain(s) which you want to be included.


3

Could you have a competitor interested in putting you offline? Are they idiots (and russia based) or could they being paying some idiot from russia? If not, then maybe you're getting hits from a single router in some educational or governmental institution in which you suddenly became popular. What are you checking their ip with? Try maxmind. Its resolver ...


3

From this question: You could do several things including: Use a CAPATCHA like reCAPTCHA Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in ...


3

It's more than likely your WordPress install has been compromised. The permanent fix is to follow these steps to ensure it is fully cleaned and to prevent a recurrence. This is the best method to ensure it is 100% clean. Backup the database Make a note of the customizations, such as plugins or any other modifications you’ve made. Remove all files from the ...


3

It became known in 2009 that IIS had a vulnerability in that it determined filetype by the part of the filename preceeding a semicolon if there was one in the name. See this NIST description for more details.


3

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


2

You state that your application's configuration was changed - are you certain that is the case? It sounds as though your database was hosted on the same server as your application itself - in which case the configuration may very well have been to access the locally-hosted database. Definitely not an ideal situation and it sounds as though you have a right ...


2

I just came across a recent YouTube video from Matt Cutts on this topic. Google is now letting webmasters disavow links: http://www.youtube.com/watch?feature=endscreen&v=393nmCYFRtA&NR=1


2

This is a question that only you can answer. If your web-hosting provider and their choice of control panel is returning your password in plain text formatting, it would suggest that they don't take the security of their platform seriously. Typically, a good hosting provider will provide security in depth. That is, multiple layers of security ranging from ...


2

Speak direct to the shared hosting company - it's not impossible there is an issue on that server and other customers are experiencing the same (similar) issues.You already updated your password information which makes no difference. How long it takes from uploading a file to when it becomes 'hijacked'?


2

You must fully audit/cleanse any PC that has had the FTP password stored on it. Remove the password from your FTP clients and change from another PC. Be very wary of storing the FTP password in your clients - especially if you are not 100% sure the malware has been removed from the infected PC. This one seems to spread through a few different means, but ...


2

It is "normal". As you already stated, they probably are bots trying to find a way to access applications with known exploits, pinging random IPs. One thing you can do is to have third party services accessible from non-standard paths and/or password protect them if necessary and helpful. As long as the bot is hitting 404 then you're safe even if you are ...


2

A few simple options to automate malware scanning of multiple sites: Use a paid automated malware scanning service such as Securi, 6Scan or SiteLock. You might want to encourage your client to sign up with these services, or offer it as part of a monthly maintenance contract. Use a free plugin for your content management system, such as Wordfence for ...


2

I like the idea of using hash sums to check for changes in files. I don't like that the one you link to is installed on the server itself. If the server is hacked, that file is likely to be modified too. I would use a command like this to ssh into each remote server and checksum all the important files in the web directory. ssh mywebsite.example.com ...


2

It is likely to be either the FTP passwords or some common software that is powering the sites. For example it is very common for an old version of WordPress to be vulnerable to this type of an attack. You should: Change your FTP passwords Update all the software powering your sites. Google just released a set of resources for Webmasters that have ...


2

Possibilities ModX EVO CMS is deleting it Malware/Virus is deleting it Shared Hosting is causing it, i.e malware/virus on another user account spreading to yours. Web host is deleting it for one reason or another. How to Investigate Contact your web host if shared hosting Check logs Quick Fix I'm assuming that you are using CHMOD 744 or 777, there ...



Only top voted, non community-wiki answers of a minimum length are eligible