4

I am facing a problem with my WordPress site. Number of visitors try to access a page that doesn't even exist on my site. It keeps generating every minute with different random php links from different ip. I installed wordfence but those pages are not showing on wordfence traffic. By facing this my site bandwidth increasing hugely.

Please refer this screenshot.

I also facing number of ip try to access my wp-login page and xmlrpc page as well.

I don't know where this came from and how to solve.

Improve this question
2
  • 3
    These requests would appear to be triggering a 301 redirect? To where? Why not a 404?
    – MrWhite
    Commented Sep 8, 2021 at 14:05
  • 1
    One minor consideration: wordpress by default has a function called redirect_cononical() which will 301 bad links to what they call canonical links, often the "news blog" default. See for example: wordpress.stackexchange.com/questions/3326 And yes this means it will not properly return a 404 unless the developer forces that functionality. This doesn't mean you haven't been hacked, just that some 301s are to be expected.
    – Yorik
    Commented Sep 9, 2021 at 19:32

3 Answers 3

Reset to default
6

Random unexpected URLs on your should be returning "404 Not Found" status. When so many weird URLs return "301 Permanent Redirect" instead, it is often a sign that your site has been hacked.

Requests to wp-login and xmlrpc are common attack vectors for WordPress. If you are seeing tons of requests to those files, many of them are likely from hackers. There are some steps you can take to harden WordPress.

Since your WordPress installation is likely already compromised, you need to clean it up. Cleaning up from a hacked site is a big process. It is too much provide all the details here. Google maintains a guide for webmasters to use when their sites have been hacked. I'd recommend starting there.

Improve this answer
7
  • Thank you.. I want to clarify that weird URLs are only showing on cPanel visitors, i have installed wordfence but it doesn't showing those URLs. And also when i click that 301 links it redirect me to 404 page. Just a week before i make force redirect my site to https, before that those URLs only showing on the http page visitors now it showing on both http and https visitors.
    – amrefayee
    Commented Sep 9, 2021 at 5:52
  • Do you have your ErrorHandler for 404 set up to be a redirect?
    – Stephen Ostermiller ♦
    Commented Sep 9, 2021 at 9:02
  • 3
    Hackers often configure the hacked site to only show the hacked content to bots and search engine visitors to make it hard to detect the hack. Just because you are clicking on the links and not seeing anything, it doesn't prove there is no hack.
    – Stephen Ostermiller ♦
    Commented Sep 9, 2021 at 9:03
  • 1
    @MohamedRefayee Are you saying that the 301 is simply a redirect from HTTP to HTTPS and the screenshot in the question shows HTTP requests, hence the redirect? And when you get a 404 page, is this the WordPress 404 page or something else?
    – MrWhite
    Commented Sep 10, 2021 at 13:05
  • @MrWhite These php pages are not existed in my site (both http and https). I force redirect my site to https after that only 301 showing on all the pages like above in http visitors. I know 301 is because of the http to https redirect that's not a problem, the problem is not existing pages (those php pages) are indexing still now i think its an seo spam or something. I found a folder on my public_html named shippingq with index.php file with alot of codes and a html page with my site header and footer with empty body. It's recreated if i delete that folder finally i manage to delete the folder
    – amrefayee
    Commented Sep 12, 2021 at 4:57
5

I looked up the IP 185.191.171.42, and it seems to be owned by SEMRush. So the possible reason is that you have second-hand domain that the old owner created those pages and SEMRush still has the list of those pages. So SEMRush is trying to crawl those pages, maybe to see the backlink or other parts of the pages for SEO analytic.

To confirm that you may contact SEMRush it's self. Or you can also block those IPs using cPanel's IP blocker or from other WAF like Cloudflare. If SEMRush is good robot you can use robots.txt as Max's comment too.

Another possibility is like Stephens's answer, if your website really hacked the best solution is creating new website with new hosting(or cleaned hosting), just import the articles/posts from old website, don't import plugins, themes or other code/script from old website. Because it's will really hard to handle especially if you don't know programming and server.

Requests to wp-login and xmlrpc are very common, even your website is not a WordPress you can get those requests from random IPs. I has many clients that use static HTML but still get requests to those pages. For non-wordpress site, that's harmless(except spending bandwidth). But for WordPress site, those requests can be handled by Stephens's guide link.

Improve this answer
5
  • 4
    If the original poster is sure that it's SEMRush, it's much more clean to block their bot by robots.txt than by IP. But Stephen's answer about malware is relevant too.
    – Maximillian Laumeister ♦
    Commented Sep 8, 2021 at 17:21
  • @MaximillianLaumeister Why block them? Crawling outdated URLs is not doing any harm. And if you block them they won't find your new site.
    – Criticizing Israel not allowed
    Commented Sep 9, 2021 at 10:22
  • 1
    @user253751 I wouldn't generally recommend people block bots like this, but the OP seemed to be having issues with bandwidth overuse. There's no harm in blocking bots that you are sure aren't helpful to you.
    – Maximillian Laumeister ♦
    Commented Sep 9, 2021 at 16:30
  • 1
    Just to confirm, all the IPs stated in the question are owned by SEMRush. There would seem to be two issues described in the question... the requests from SEMRush (for possibly "old" URLs) and the requests for wp-login and xmlrpc by other IPs.
    – MrWhite
    Commented Sep 10, 2021 at 12:59
  • @MrWhite Most of the IP are belong to SemRush and wp-login, xmlrpc request are not from SemRush
    – amrefayee
    Commented Sep 12, 2021 at 5:09
3

I think might be "hacked". xmlrpc is a common attacked used by hackers alike. I use Wordpress Expose from Chris G. Herbert to check if it can list username. I don't know the exact.

But some people seems to be pointing to SEMRush which is an online digital marketing related. So they might still craw your website.

Limit Login Attempts Reloaded might be what you need for checking out against brute force logins or Wordfence, another popular plugin to check your security and scan for infected files.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.