Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!".

I am using a server provided by Free Hostia. I contacted them, but they say they don't provide any "site script debugging service". How can I get my website back?

  • You've got a JS/TrojanDownloader.Iframe.NJT on your site – according to ESET Smart Security.
    – user5209
    Commented Feb 9, 2011 at 14:02
  • I too face the same problem, and am also hosted at freehostia, I thought maybe a competitor found a way to get it black listed... in this industry, I wouldn't put it past them.
    – user21360
    Commented Jan 11, 2013 at 6:01

3 Answers 3


Your site currently has some malicious Javascript embedded in the bottom of your site that embeds an iframe in your page. This could infect visitors with malware, attempt to steal their passwords, or do all sorts of other nasty things.

There are a couple of steps you can take to remedy this problem.

Reinstall the latest version of WordPress

It's very important that you keep up to date with any web applications you're using on your web site. Older versions can contain security vulnerabilities that can be used to infect your page with foreign code or content.

Since it looks like your site is using WordPress, I'd recommend reinstalling the latest version and starting from a clean slate. You may lose any previous posts and/or comments, but you also don't want to carry along any of the infection with the previous content.

If you'd like to keep your current post, I would recommend copying them into a text file first, and them pasting them into the new installation as new entries. This way, you can make sure that no residual code is present.

Change your FTP Password

Often, attackers can get in to your web site if you have a weak FTP password. Additionally, if you don't use sFTP, your password is sent in clear text across the Internet and can be intercepted.

Using a strong password (more than eight characters, mixed with numbers and symbols, without any common words) and connecting through secure channels can help prevent this.

Clean out any unfamiliar files

Make sure to check your web root for any files you don't recognize. If your account has been compromised, attackers may leave a backdoor script as a method of re-compromising your site.

Check for any files with odd modification times - times that you wouldn't have uploaded files to your web site, for instance.

Consider changing hosting providers

If you're already following good security precautions, then you might not be at fault. If FreeHostia is running server software that contains a vulnerability, or they don't follow security practices themselves, there is nothing you can do to secure your web site. Make sure to host your web site with a reputable host.

  • 2
    Good answer. I'd also like to add, be very careful where you install WordPress themes and plugins from. See: wpmu.org/…
    – aendra
    Commented Feb 9, 2011 at 21:21

You're using WordPress and haven't updated, your source says 2.8.2.

At the bottom of your page is a script. eval(unescape('%64 ...

Check your theme files and the database, check the WordPress files or maybe try a clean install and restore the database.

Searching 'wordpress eval 64' has lots of results but pretty much you have to clean your files of that. It could just be the footer of your theme though.

Here's a link, http://wordpress.org/support/topic/evalbase64_decode-hacked, to the WordPress forums with links and help.


You apparently have a security vulnerability in your code.

You need to fix the vulnerability and remove all traces of the attack from your database and/or files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.