2

Server was hacked and my .htaccess file was changed to wildcard redirect (spam).

I am seeing a lot of requests like those below even after I've cleaned up my server:

example.com/cobwebbing-gurkha1486mskh27556/64b75843rl69s2/
example.com/countercheck-gurkha1486mskh22793/n4a670a2h43m/
example.com/countercheck-gurkha1486mskh19573/36c9on2137rs/

How can I change those URL to 410 Gone? I'd like to redirect them to a page I've made (fail.php) that issues a 410 header.

Here is the current hacked htaccess. I tried to make the end part of the file (?gurkha) to go to fail.php but it doesn't seem to work. It keeps going to a the WordPress 404 page. The WordPress 404 eats up system memory and I'd like a more elegant and efficient way to handle these URLs.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteRule ^\/(.*)-(gurkha)([0-9]+)mskh([0-9]+)\/(.*)$ ?gurkha$3=$4&%{QUERY_STRING}[L]
</IfModule>

I'd really like to get these URLS off google. How can I change my .htaccess so they are 410 Gone?

  • You need a space before the [L] in your final rerwrite rule and you need to move it up before the RewriteConds. MrWhite's answer that shows how to return the status directly at the URLs would be better though. You shouldn't redirect to show a different status. – Stephen Ostermiller Mar 12 '18 at 15:37
1
/cobwebbing-gurkha1486mskh27556/64b75843rl69s2/
/countercheck-gurkha1486mskh22793/n4a670a2h43m/
/countercheck-gurkha1486mskh19573/36c9on2137rs/

To make an URL that contains -gurkha followed by a digit, fail early with a system generated 404 (bypassing WordPress), then you can use something like the following at the top of your .htaccess file:

RewriteRule -gurkha\d - [R=404]

Note that this must go before the WordPress front-controller. ie. before the <IfModule mod_rewrite.c> directive. You do not need to repeat the RewriteEngine directive.

UPDATE: If, however, you still see a WordPress generated 404 page then it's possible that you have a custom 404 error document that points to a WordPress document (eg. 404.php). You can reset this to the simple Apache default by including the following in your .htaccess file:

ErrorDocument 404 default

If you want Google to drop these URLs quicker then you can change the R=404 flag to G (gone) to serve a 410 Gone instead. (Although this potentially alerts users/bots/hackers to this - but that probably is not a real concern.) Again, reset the ErrorDocument (as above) if you still see a WordPress page returned.

You can then use the Google Search Console URL removal tool to explicitly remove these URLs from the SERPS.

A 401 Unauthorized response won't necessarily make Google drop the URL. And it will only likely raise further suspicion. (Although, it seems the OP initially referenced "401" in error and actually meant "410".)


<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteRule ^\/(.*)-(gurkha)([0-9]+)mskh([0-9]+)\/(.*)$ ?gurkha$3=$4&%{QUERY_STRING}[L]
</IfModule>

You should remove that last RewriteRule. As it stands, it will not do anything, but also has several "errors":

  1. In per-directory .htaccess files, the URL-path that the RewriteRule pattern matches against never starts with a slash. So, this RewriteRule would never match anything in this context.
  2. By placing this directive after the front-controller, it will only be seen for URL requests that map to physical files or directories. These URLs probably don't map to real files/directories, so again it would never match.
  3. By placing directive inside the # BEGIN WordPress / # END WordPress block then it will likely get overwritten when WordPress updates.

Other, "less serious" points regarding that last RewriteRule:

  1. There is no space between the CondPattern and the flags (ie. before the [L]). This would potentially result in an invalid rewrite. And potentially cause problems if you later added more directives (because there is no L flag).
  2. No need to backslash escape slashes (eg. \/) in standard Apache regex. (Spaces are used as delimiters and slashes otherwise carry no special meaning.)
  3. Many unnecessary captured groups (parenthesised subpatterns) that are not used.
  • I tried it, it still goes to 404 wordpress, even at the very very top, but i put this in, and it works.. ErrorDocument 401 /fail.php RewriteRule -gurkha\d - [R=401] and then in fail.php I have nothing exept a Header 401 and it seems to fire off the default 401 for apache and not wordpress. Is what i have ok? if i goto any other URL it goes to the 404 page in wordpress so it seems to only work for that regex? or maybe its any 401 page since i defined it custom – Zuriel Mar 12 '18 at 0:03
  • and console log now says this "Failed to load resource: the server responded with a status of 410 (GONE)" – Zuriel Mar 12 '18 at 0:04
  • Do you have anything else in your .htaccess file? RewriteRule -gurkha\d - [R=404] should not trigger the WordPress 404, unless you perhaps have an ErrorDocument defined somewhere that sends these requests through WordPress?! But you shouldn't be sending a 401 if you want these URLs to be dropped from the SERPs - I've added a note to my answer. – MrWhite Mar 12 '18 at 0:09
  • "in fail.php I have nothing exept a Header 401" - you wouldn't even need the "Header 401" if you've defined an ErrorDocument - Apache will already send the appropriate response header. – MrWhite Mar 12 '18 at 0:11
  • 1
    your answer got me to where I need. I made a small tweak to get the 410 error redirect page to show up and bypass wordpress by doing the ErrorDocument 410 /410.php but other than that we are good to go. Thanks for your help – Zuriel Mar 12 '18 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.