3

When I examine one of my self-hosted WordPress sites using the Structured Data Testing Tool of Google Webmaster Tools, I was shocked to see links to 2 spam sites inside the "HTML" tab!

However, when I searched for these spammy links inside the actual site -- by examining both the output of my browser's "view source", as well a phpMyAdmin-created dump of the MySQL database -- I could not find any hint of this spam!

BTW, I see from this "Spammers spamming the Google Structured Data Testing Tool" article, that this is a known issue.

My main question is: have these links truly been injected into my site itself, and -- if so (so that I can clean up the damage) -- where exactly?

[Or, is it GWT or some other entity external to my site that has somehow been hacked? In such a case, is there anything that I can do to fix and prevent the problem?]

[BTW and FYI: the website was originally hosted on WordPress.com, and now has a "Site Redirect" upgrade pointing to the new self-hosted site.]

3

Interesting page on spamming Google Structured Data Testing Tool. Thanks for sharing it. It appears that Google has has locked this down. But this is a situation where the one using the tool tries to fool it deliberately. I assume that is not you.

There are cases where Wordpress and other CMS vulnerabilities are exploited and links appear conditionally. This may be one of those cases. Vulnerabilities do not define what is done with them however so each situation is different.

I would HIGHLY(!) recommend using a good anti-virus to fully scan your hard-drive(s) including rootkit. If you are on a hosted site (of any type), then you may be able to get your web host support to do this for you. It is not uncommon that hosted sites are hacked though most hosting companies are very serious about keeping up to date. It is easy to miss something or for an unknown vulnerability to be compromised and then discovered. It may be that they are unaware of a vulnerability that likely exists on many sites.

DO NOT USE an ONLINE web based anti-virus. They are incomplete.

But then again, the most hacked PHP application is Wordpress. This is not that the Wordpress coders are sloppy, but rather it is the most deployed and active blog software there is including plug-ins and such from third parties. You may not see evidence in your Wordpress database at all or in every case where you may hit your site. Some folks find these links using a proxy or other tool that scans the site.

While your site is being scanned, check for updates to software that is installed on your site. Try and make sure that you are up to date. Some of this may be your hosts responsibility. Some of it may be yours. It all depends on the situation.

It is not clear what situation you are experiencing. I offer the suggestion of scanning your system with an anti-virus because it is fairly common that phantom links show up and that Wordpress sites experience issues such as this.

[Update] I found this.

http://wordpress.org/support/topic/wordpress-site-hacked-need-help-1

It is the only thing I found (so far) at all close to what you are experiencing. Clearly it is a Wordpress or plug-in issue. I would not expect that you will see anything in your database. Knowing hackers, they avoid this and would try and be far more sneaky. You will want to make sure that you are running the latest Wordpress code and plug-ins of course. You may also need to remove or disable various plug-ins one at a time to see if the problem disappears. It may not, however, I suspect that you will be able to determine exactly where the problem lies using this method. You may need to remove and delete the Wordpress install and re-install, but let's hope not. I believe in taking the simplest least draconian solutions first.

  • Thanks for the suggestions. My system is clean of malware, but still need to check that of client (site owner & content writer) and shared hosting. However, my main question still remains: where exactly might these spam links -- that (I think) show up only in the Structured Data Testing Tool -- have been injected? I.e., where specifically in the database? Or perhaps in one of the PHP files? Any suggestions? – NewBee Aug 31 '14 at 2:12
  • 1
    @NewBee I found something that may help. I updated the answer. – closetnoc Aug 31 '14 at 4:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.