1

I help someone run a WordPress blog. When you Google the website, www.plus10tofireresist.com, it comes up stating "This site may be hacked." At one point there were a bunch of hits to the site reported through Google and WordPress analytics. None of the sites that Google sees actually exist. If I manually type the address in the browser the Blog returns a 404 inside the theme of the page. If I click the link that shows up in a Google search it seems to automatically redirect to a porn site.

Google search console thinks that a couple sites in the blog may have been hacked with URL injection as well. One of the sites it lists again does not exist. The other two have not been hacked as far as I can tell.

Again these pages that Google is listing do not actually exist beyond a 404 error. They may have existed at one point as there was an issue with site security but it has been almost a year since that happened.

We are concerned Google may eventually blacklist the entire site over this.

|improve this question
  • Would you be able to provide an actual URL that is hacked on your site? I have a feeling someone modified a server configuration file to serve different content to search engines. – Mike Jan 26 '16 at 3:49
  • Yep. It sounds like your site was compromised. Very common. Update all of your software. Remove any user accounts you did not create or need. Reset all passwords - you do it not the user. Then carefully check your database and files. You may need to redeploy your site from backups taken prior to when your site was compromised. As well, themes and plug-ins can make a site vulnerable. Check all software, themes, and plug-ins for issues here: web.nvd.nist.gov/view/vuln/search?execution=e2s1 – closetnoc Jan 26 '16 at 4:43
1

This sounds like a case of cloaking. This is a way to tell one thing to user A and another to user B.

This often happens with porn sites.

The concept is relatively simple: a PHP script gets installed on your website and whenever the site gets a hit, it checks the USER_AGENT parameter. If the USER_AGENT says it's a GoogleBot computer, reply with a 301 redirect to the porn site. Google will register the final URL and eliminate all the 301 in their search results.

Now since Google removes the 301, if you go directly to that page, you get the normal 404 because the PHP script sees your USER_AGENT parameter and you are not browsing like a GoogleBot. This prevents you from noticing unless you check with Google Console (a.k.a. Google Webmaster) or with a search like you've done.

To fix the situation you have to find the PHP script that does that to your website. If you're a programmer, it probably won't be too hard. If you're not, creating a new installation from scratch and copying the data may be the easiest way to fix the problem. However, Wordpress puts a lot of PHP code under the wp-content folder... code that could be doing the cloaking.

There is a page that describes the situation further:

https://snapwebsites.com/journal/2012/06/snap-seo-what-cloaking-and-why-search-engines-do-not-it

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.