I've been facing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at the same time (2) are identical.

Does this prove that my FTP passwords have been stolen (they're all stored in Filezilla XML file on my hard drive) ? What else could be the security hole?


It is likely to be either the FTP passwords or some common software that is powering the sites. For example it is very common for an old version of WordPress to be vulnerable to this type of an attack.

You should:

  • Change your FTP passwords
  • Update all the software powering your sites.

Google just released a set of resources for Webmasters that have been hacked. You may find more information there that is relevant to your situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.