Right before christmas i noticed that my website suddenly had a steep drop off in users. Once I got to the bottom of things it turned out that google delisted me because my website had been hacked via SQL Injection for Viagra products etc.
I proceeded to figure out what happened and how to remedy the situation. First I protected my site by...
- changing the passwords on my WP Admin acct
- changing the FTP password
- changing the MySQL password
- changed my hosting acct password
I downloaded my entire SQL database and did string searches for "viagra" and found nothing. Thus i thought my DB is not affected.
I then found two suspicious files in my FTP top level folder (rootfolder). My
.htaccess file had been modified. I changed it back to my last backup version. In addition i deleted two suspicious files that were clearly part of the hackers doing (
I ran the Fetch as Google Tool in my Webmaster account. All the cloaked content that google picked up was gone and my site seemed to have been restored to its previous state. YEAH!
Today I looked at the Google Webmaster Security console again... new pages were listed as hacked & cloaked!!!
Now when I try to fetch and render them as google, google tells me the pages are "redirected"! I used a plugin to delete all redirects on my website, but google webmaster still tells me that the pages are redirected.
Where on my website can I check up on this? Any tipps and help is greatly appreciated! (i have Linux hosting if it helps)