2

Yesterday we found out that in Google Search, the website is reported as

"This site may be hacked."

It is a Joomla website. In webmasters tools there is a report for URL Injections. There is only 1 url showing there and it looks like a .html url page inside Joomla's /cli directory. I followed the URL and all I got was a 404 error for that page. I inspected the cli directory via FTP and also found nothing there.

We are hosting on managed Dedicated Server with a high reputable and experienced host. We are putting a lot on security. For example we run daily malware scans and file changes scans, we have strict firewall rules and WAF enabled, we have latest Joomla version installed and all extensions we have installed are reported as non vulnerable. From the scanners reports we have not seen any unexpected changes in the files/directories structures. I reviewed the htaccess - nothing suspicious in there also.

I tried to fetch as Google the reported URL - first it was not allowed, as the cli directory is disallowed through robots.txt. I changed the robots.txt temporary, and tried again and Google crawler reported back that this is a 404 page.

I also did the site:example.com search but this URL isn't appearing in the results - also no other unexpected urls appeared there.

I also tried to reach to this URL via pingdom, gtmetrix, a VPN connection using a few different IP locations and still everything I get is a 404.

So, having done everything Google suggests and even more, I submitted a request for review in webmasters tools.

However, today I checked the webmasters security issues report again and this same URL is showing with last detected date of today. I did all tests again from scratch - still this URL isn't existing on our website. I submitted again a request for review - asking for some feedback and more clues from Google - e.g. a referrer page - not sure though if Google is able to respond via this channel.

But how can Google see this URL as an existing page in our website? Add to this that our cli directory is disallowed through robots.txt.

Also, what else do I have to do in order to remove the mark of this site might be hacked?
Any chance this is something like a bug/error by Google?

Also, I am posting here the part of the URL Google reports as URL Injection - as it may be something someone from you might have seen again:

/cli/Qv2-shopping_ocsU8.html

Any input, suggestions are appreciated.

Update 1

I also have checked the access logs for this URL. The first entry I found was my own first try to reach to this URL, after finding in webmasters with a 404 HTTP response. Google is only reported later on, after I was requesting to crawl that URL - again logged with a 404 response.

I have no clue so far of how and why Google has discovered and reporting this URL.

Update 2

Some days later and various efforts, Google Webmasters Tools is still reporting that URL as a detected one.

What else I have done: Explicitly allowed GoogleBot in our robots.txt to access the said url, as previously it was not allowed to crawl it, and fetching it as google it was stopping because of the robots.txt. So now Google can see this URL is a 404.

Now from the Security Issues menu this is the road I am taking:

  1. I see the injected URLs report - last detected 2016-11-22
    Clicking Show Details.

step 1

  1. In the details window I see the option to fetch as Google, which I click to do..

step2

  1. Fetching as Google returns a 404 error for that URL. step 3

    • I have submitted many times that the issues are fixed and request a review - but nothing happens and Google always update the report saying that this URL is last detected again every day.

I am out of other ideas of what to do here.

  • Sorry but currently its unanswerable without guessing... the question is also likely duplicate since we already have a vast amount of questions regarding webmaster tools and 404. To save your time within those questions and answers you will find a common theme which is to click the 404... and click linked from... if its an external link pointing to that URL that doesn't exist then it means your server is working... 404 doesn't imply your server is broken. If the LINKED from data is occurs locally then you need to investigate and fix the cause. – Simon Hayter Nov 19 '16 at 18:20
  • I reopened your question due to the fact that Google is reporting your site could be hacked. However can you confirm or not the 'site may be hacked' is relevant to the 404... Its unlikely that is the hack... because Google wouldn't report a hack on a 404, it would find it elsewhere on the site. You should however investigate the linked from DATA as mentioned in the previous comment. – Simon Hayter Nov 19 '16 at 18:22
  • @SimonHayter: There is no linked from data -The only info I get from google is this url - which doesn't exist but Google insists it detected it again today. – FFrewin Nov 19 '16 at 19:35
  • Don't see how its in your 404 list then... because the only way it can get there is a linked from or this is a previous problem that has been fixed and you haven't clicked this issue has been fixed. Furthermore how do you know the 404 is even remotely related to a hack? – Simon Hayter Nov 19 '16 at 21:44
  • @SimonHayter I m clicking on I have fixed these issues - fetching as google this url returns a 404 - and yet webmasters tools is still reporting every new day that this url is detected. I have update my question with the screenshots from GWT - i m out of ideas... – FFrewin Nov 22 '16 at 14:20
1

I don't know if this will help but I have a few ideas:

I have seen this message on sites that used JS based A/B testing software so perhaps that'll help.

Did you check and see if that URL ever existed or if there are any links to it?

Try configuring the server to return a 410 "gone" HTTP header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.