3

I am helping a client figure out some weird URL issue and I am stumped! Google Webmaster tools shows a couple of hundred "pages" that essentially don't exist and look pretty spammy, also using wording that is apparently trademarked. We suspected it was a hack, so we cleaned up the site. But the pages are still showing. Some examples of these naughty-looking URLs: 

http://www.example.com/?page=vista-group-payday-loan 

http://www.example.com/index.php?page=us-cash-loan.com

The first link came up with a cease and desist from the trademark owner. The rest came from HTML Improvements area in Google Webmasters as "Short Meta Descriptions."

The pages themselves don't show anything malicious, in fact it just shows the website's home page. The site is built in Wordpress and the pages don't actually exist. We now suspect this was the work of a previous SEO company. But that's about all I have - I can't figure out WHAT it is (keyword ads? link building?). I'm not an SEO expert and my skills are limited, but I thought perhaps you guys may know what the heck these URLs are, and I need to remove them STAT.

Improve this question
5
  • 1
    We get these questions a lot!! The site was clearly hacked. If you are on a shared server, then you will need the help of the host. It is possible that one site can effect another. Otherwise, the hard-drive should be scanned with an anti-virus tool including rootkit. Update all software. Check all remaining software including themes and plug-ins for vulnerabilities here: web.nvd.nist.gov/view/vuln/search?execution=e2s1 Change the passwords for all users yourself - not user directed. Audit all user accounts - some may be made by the hacker. Clean the database and files.
    – closetnoc
    Jan 8 '16 at 18:28
  • I moved the site over to a new host, installed a new version of wordpress (new database) and started from scratch, importing the xml content only. I don't see any malicious code in theme files, and when I started from scratch with a standard Wordpress theme the links were still active. The host did a full scan and found no malicious code.
    – Kelly Erickson
    Jan 8 '16 at 19:05
  • I do not know WP at all. But if you have a new host, meaning a whole new company, then you somehow brought it over with you from backup or something.
    – closetnoc
    Jan 8 '16 at 22:08
  • This is so crazy - I removed everything and rebuilt the site from scratch with a new theme, etc. Cleared the database. The links are STILL showing! The hosting company says the site is all clear. I'm running some redirects right now to see if that'll work....
    – Kelly Erickson
    Jan 9 '16 at 1:11
  • 1
    Please know that some viruses will effect WP (and other CMS/sites) from outside of WP/CMS/site. As well, it is possible that if you are on a shared server, another site has been compromised and continues to effect your site. This would mean that a host would have to scan/examine the entire server and all of the sites. It could be something else that is compromised such as Java or a commonly installed script or control panel. This can be tough to bird-dog, but often once found it is rather easy to resolve. Push comes to shove, a move to another server may help quickly.
    – closetnoc
    Jan 9 '16 at 4:02
1

First, check to see that you have actually cleaned up the hack. Even though the pages may look normal to you, malware on websites is often configured to server spam only to Googlebot. Log into Google Search Console and use the "Fetch as Google" feature on those spammy URLs to ensure that Googlebot is seeing the homepage just like you.

If the hack truly is cleaned up, you now have lots of duplication in Google's index. Google should sort it out on its own eventually, however you can help it along. One of the easiest ways is to put a meta link rel canonical tag in each of your pages. The tag on your home page would be:

<link rel="canonical" href="http://www.example.com/">

The tag on a deeper page might be:

<link rel="canonical" href="http://www.example.com/deep-page.html">

That way when Googlebot fetches the home page multiple times at different URLs, it will know that all those are the home page. It will index the preferred canonical URL for the content that you have specified.

Since you are using WordPress, there are many SEO plugins for it that add these canonical tags for you. You would need to search for one and install it.

Improve this answer
3
  • You can also use the "User Agent Switcher" extension to Chrome (or similar plugin/whatever for your browser of choice) to test your WordPress site to see if it serves a hacked page or not.
    – JCL1178
    Jun 8 '16 at 19:38
  • User agent switcher will often work, some some hacks identify Googlebot by both user agent and IP address. You really can't be sure unless you use Google's tool.
    – Stephen Ostermiller ♦
    Jun 8 '16 at 19:51
  • True. I should have indicated more as a "step before" you go full Google. Sometimes the lazy hacker just checks the user-agent and saves you 5 minutes of extra work.
    – JCL1178
    Jun 8 '16 at 19:58
0

Regardless of whether you were ever hacked, those links will also be coming from other sites. They don't hack your site only; they hack sites by the thousands (using automated methods which attack known bugs of popular CMS's) and have each site link to each other in a classic link exchange SEO strategy.

So potentially hundreds of other sites also link to these now-gone spam URLs. You can't do anything about that. Because of that, links from other sites to your site are not counted against your site. (just not for it either; so if you enjoyed a temporary unnatural boost, expect it to rollback.)

As long as you make sure your site is clean, the bad URLs serve the same page as without the ?... etc., you will get inquiries for those bad URLs indefinitely, but your site should be ok.

Improve this answer
0
  1. Replace files to default WP files, including wp-admin and wp-includes. Keep wp-config.php file.
  2. Try changing the theme or downloading a new theme zip folder and upload that folder to wp-content/themes delete old theme folder and replace it the new unzipped folder.
  3. Do an audit to all plugin, delete the ones you are not using anymore/outdated
  4. Delete any unauthorized user and duplicated tables in the database.
  5. Do a search LIKE %Search Term% to all database and try to spot the problem inside the database record.
  6. Change Host o Increase WP security via Plugin or Htaccess file.
Improve this answer
3
  • This answer is probably insufficient to clean most hacked WordPress sites. It may remove the initial hack but doesn't do enough to discover or prevent future hacks using the same vulnerability.
    – JCL1178
    Jun 8 '16 at 19:33
  • @JCL1178 The question is not about hacks our how to increase security in your WordPress sites. The problem in question is usually fixed 95% of the times using that sort of a check list.
    – Raul Reyes
    Jun 12 '16 at 1:25
  • The question absolutely is about that, it's just dealing with the SEO aftereffects. Your claim of 95% needs a citation or it's just, like, your opinion man or your anecdotal experience. In either case, my anecdotal experience is different than yours.
    – JCL1178
    Jun 13 '16 at 4:05
0

Simply moving your site around to a new ISP or reloading WordPress as a fresh install is usually insufficient to stop a hack like this. Something, somewhere in your site is subject to a remote exploit and/or you're not actually cleaning anything with your attempts. If you have a vulnerable theme or plugin file, the hackers can activate it no matter which host you move to and inject the hack. If you are not actually cleaning anything with your attempts, the hack is still there and dormant.

With a few exceptions, I would not trust an ISP to scan and fix WordPress hacks unless they are pretty obvious file modifications. Remote injections that take advantage of poorly coded plugins can be subtle and hard to deal with. You would be better off doing one of the following steps:

  1. Move your site to a host that provides dedicated WordPress plans that include security monitoring and remediation. These include companies like WPEngine, Pressable, Pagely, and a bunch of others (I have no affiliation with any or all of them). If you have a known-bad plugin or security issue, they will discover it in short order. If not, they will help you close the security issue once you report it on their hosting platform. It's worth the slightly higher hosting cost
  2. Contract with a security service to audit and clean/harden your site. The two I know of that do good work are Sucuri and WordFence. Sucuri's been around longer, WordFence is new to the "clean the hacked site" game but they're good and trying hard to knock Sucuri off the top. So either one would be a good choice for a one-time expenditure to fix this issue that basic steps have yet to fix.

Good luck.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.