Wednesday, February 18, 2015<\/p>\n
\n Every day, thousands of websites get hacked. Hacked sites can harm users by serving malicious
\n software, collecting personal information, or redirecting them to sites they didn’t intend to
\n visit. Webmasters want to fix hacked sites quickly, but unfortunately recovering from a hack can
\n be a complicated process.\n<\/p>\n
\n We’re trying to make the process of recovering from a hack easier for webmasters with features like \n A restaurant website using WordPress received a message from Google in their Webmaster Tools \n Sam removed all of the hacked content she found and filed a reconsideration request. The request \n Even though Sam had cleaned up the hacked content on her site, she knew that she would need to \n A small business owner named Maria who also manages her own website received a message in her \n Maria then went to Webmaster Tools and used the Fetch as Google tool on the example URL Google had \n Verify the non-www version of her site as hackers often try to hide content in folders that \n While it may seem like Check her \n Maria talked to her hosting provider who showed her how to access her \n The \n She removed the \n We hope your site never gets hacked, but if it does, we have many resources for hacked webmasters Wednesday, February 18, 2015 Every day, thousands of websites get hacked. Hacked sites can harm users by serving malicious software, collecting personal information, or redirecting them to sites they didn’t intend to visit. Webmasters want to fix hacked sites quickly, but unfortunately recovering from a hack can be a complicated process. We’re trying to make […]<\/p>\n","protected":false},"menu_order":83516,"template":"","meta":{"footnotes":""},"ar_kb_kategori":[665],"ar_kb_etiket":[],"class_list":["post-24866","ar_kb","type-ar_kb","status-publish","has-post-thumbnail","hentry","ar_kb_kategori-blog"],"_links":{"self":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb\/24866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb"}],"about":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/types\/ar_kb"}],"version-history":[{"count":0,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb\/24866\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/media\/27052"}],"wp:attachment":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/media?parent=24866"}],"wp:term":[{"taxonomy":"ar_kb_kategori","embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb_kategori?post=24866"},{"taxonomy":"ar_kb_etiket","embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb_etiket?post=24866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n Security Issues<\/a>,
\n Help for Hacked Sites<\/a>, and
\n a section of our forum just for hacked sites<\/a>.
\n Recently we talked to two webmasters with hacked sites to learn more about how they were able to
\n fix their sites. We’re sharing their stories with the hope that they might provide ideas to other
\n webmasters who have been victims of hacking. We’re also using these stories and other feedback for
\n improving our documentation for hacked sites to make the process easier for everyone going
\n forward.\n<\/p>\nCase Study #1: Restaurant website with multiple hack-injected scripts<\/h2>\n
\n account, alerting them that their site had been altered by hackers. To protect Google users, the
\n website was labelled as hacked in Google’s search results. The webmaster of the site, Sam, looked
\n at the source code and noticed many unfamiliar links on the site with pharmaceuticals terms such
\n as “viagra” and “cialis.” She also noticed many pages where the meta description tags (in the
\n HTML) had added content such as “buy valtrex in florida.” There were also hidden div<\/code>
\n tags (also in the HTML) of many pages that linked to many sites. None of these links were added
\n by Sam.\n<\/p>\n
\n was rejected but in the message she received from Google, she was advised to check for any
\n unfamiliar scripts in the any PHP files (or any other server files), as well as changes to the
\n .htaccess<\/code><\/a>
\n file. These files are likely to have scripts added by the hackers that modify the site. These
\n scripts typically only show the hacked content to search engines, while hiding the content from a
\n normal user. Sam checked out all of the .php<\/code> files and compared them to the clean
\n copies she had in her backup. She found new content added to her footer.php<\/code>,
\n index.php<\/code>, and functions.php<\/code>. When she replaced those files with the
\n clean backups, she could no longer find any hacked content on her site. When she filed another
\n reconsideration request, she got a response from Google notifying her that her site no longer had
\n hacked content!\n<\/p>\n
\n continue to
\n secure her site<\/a>
\n against future attacks. She followed the steps below to keep her site safe in the future:\n<\/p>\n\n
\n most current version. Make sure plugins are up to date as well.\n <\/li>\n
\n unique password.\n <\/li>\n
\n 2-step verification<\/a>
\n for login. (This might also be called two factor authentication or two step authentication.)
\n This is recommended for the account being used for password recovery as well. Most email
\n providers, like
\n Google<\/a>,
\n Microsoft<\/a>,
\n Yahoo!<\/a>
\n all support this!\n <\/li>\n
\n themes can often contain code that makes it even easier for hackers to get in!\n <\/li>\n<\/ul>\nCase Study #2: Professional website with lots of hard to find hacked pages<\/h2>\n
\n Webmaster Tools that her site was hacked. The message provided an example of a page added by
\n hackers: https:\/\/example.com\/where-to-buy-cialis-over-the-counter\/<\/code>. She talked to her
\n hosting provider who looked at the source code on the home page but could not find any
\n pharmaceutical keywords. When the hosting provider visited
\n https:\/\/example.com\/where-to-buy-cialis-over-the-counter\/<\/code>, it returned an error page.
\n Maria also bought a malware scanning service but the service was not able to find any malicious
\n content on her site.\n<\/p>\n
\n provided (https:\/\/example.com\/where-to-buy-cialis-over-the-counter\/<\/code>) which returned
\n no content. Confused, she filed a reconsideration request and received a rejection message which
\n advised her to do two things:\n<\/p>\n\n
\n may be overlooked by the webmaster.\n <\/p>\nhttps:\/\/example.com<\/code> and https:\/\/www.example.com<\/code>
\n are the same site, Google actually treats these as different sites.
\n https:\/\/example.com<\/code> is referred to as the “root domain” while
\n https:\/\/www.example.com<\/code> is called the subdomain. Maria had
\n https:\/\/www.example.com<\/code> verified but not https:\/\/example.com<\/code> verified
\n which is important because the pages added by hackers were non-www pages like
\n https:\/\/example.com\/where-to-buy-cialis-over-the-counter\/<\/code>. Once she verified
\n https:\/\/example.com<\/code> she was able to successfully see the hacked content on the
\n provided URL with the Fetch as Google tool in Webmaster Tools.\n <\/p>\n<\/li>\n.htaccess<\/code> file for new rules.<\/p>\n.htaccess<\/code>
\n file. She noticed right away that her .htaccess<\/code> file had some strange content
\n that she had not added:\n <\/p>\n
\n mod_rewrite<\/code><\/a>
\n rule you see above was inserted by the hacker and redirects anyone coming from certain search
\n engines, as well as search engine crawlers, to main.php, which generates all of the hacked
\n content. It’s also possible that these rules can redirect users accessing the site on a mobile
\n device. On the same day, she also saw that a recent malware scan found suspicious content on
\n the main.php<\/code> file. One top of that, she also noticed an unknown user in the FTP
\n users area of her website development software.\n <\/p>\n<\/li>\n<\/ol>\nmain.php<\/code> file, the .htaccess<\/code> file, and removed the
\n unknown user from her FTP users area and her site was no longer hacked!\n<\/p>\nSteps to prevent getting hacked in the future<\/h2>\n
\n
\n including passwords. Instead, use SFTP, which will encrypt everything, including your password,
\n as a protection against eavesdroppers examining network traffic.\n <\/li>\n.htaccess<\/code>. Your hosting provider may
\n be able to assist you if you need help. The .htaccess<\/code> file can be used to improve
\n and protect your site, but it can also be used for malicious hacks if they are able to gain
\n access to it.\n <\/li>\n
\n place where there may be users that can modify your site.\n <\/li>\n<\/ul>\n
\n on our
\n Help for Hacked Sites page<\/a>. If
\n you need more help or would like to share your own tips, you can post in our
\n Webmaster Help Forum<\/a>.
\n If you do post to the forum or submit a reconsideration request for your site, please include
\n #NoHacked<\/code>.\n<\/p>\n