\n Even if your site is not infected with this specific type of hack, many of these steps can be
\n helpful for other types of hacks. Next week, we’ll be following up with a post about fixing this
\n hack. Follow along with discussions on
\n Twitter<\/a> and
\n Google+<\/a>
\n using the #NoHacked tag.
\n (Part 1<\/a>,
\n Part 2<\/a>,
\n Part 3<\/a>)\n<\/p>\n
- \n
- \n Identifying Symptoms<\/a><\/p>\n
- \n
- \n Gibberish pages<\/a>\n <\/li>\n
- \n Cloaking<\/a>\n <\/li>\n<\/ul>\n<\/li>\n
- \n Monitoring your Site<\/a><\/p>\n
- \n
- \n Looking for a surge in website traffic<\/a>\n <\/li>\n
- \n Tracking your site appearance in search results<\/a>\n <\/li>\n
- \n Signing up for alerts from Google<\/a>\n <\/li>\n<\/ul>\n
- \n Diagnosing your Site<\/a><\/p>\n
- \n
- \n Gathering tools that can help<\/a>\n <\/li>\n
- \n Checking for hacked pages<\/a>\n <\/li>\n
- \n Checking for cloaking on hacked pages<\/a>\n <\/li>\n<\/ul>\n<\/li>\n
- \n Appendix<\/a>\n <\/li>\n<\/ul>\n
![](\"https:\/\/alienroad.com\/wp-content\/uploads\/kb-gorsel\/g-cdf9dc297b7e.png\")
<\/p>\nIdentifying Symptoms<\/h2>\n
Gibberish pages<\/h3>\n
\n The hallmark of this type of hacking is spammy pages that appear to be added to the site. These
\n pages contain keyword-rich gibberish text, links, and images in order to manipulate search
\n engines. For example, the hack creates pages like
\nwww.example.com\/pf\/download-2012-free-full-crack.html<\/code><\/a>
\n which contain gibberish content like below:\n<\/p>\n![](\"https:\/\/alienroad.com\/wp-content\/uploads\/kb-gorsel\/g-05cf5f9f2459.png\")
<\/p>\nCloaking<\/h3>\n
\n This hack often uses
\n cloaking<\/a>
\n to avoid webmasters from detecting it. Cloaking refers to the practice of presenting different
\n content or URLs to webmasters, visitors, and search engines. For example, the webmaster of the
\n site might be shown an empty or HTTP404<\/code> page which would lead the webmaster to
\n believe the hack is no longer present. However, users who visit the page from search results will
\n still be redirected to spammy pages, and search engines that crawl the site will still be
\n presented with gibberish content.\n<\/p>\nMonitoring your Site<\/h2>\n
\n Properly monitoring your site for hacking allows you to remedy the hack more quickly and minimize
\n damage the hack might cause. There are several ways you can monitor your site for this particular
\n hack.\n<\/p>\nLooking for a surge in website traffic<\/h3>\n
\n Because this hack creates many keyword heavy URLs that are crawled by search engines, check to
\n see if there was any recent, unexpected surges in traffic. If you do see a surge, use the
\n Search Analytics tool<\/a>
\n in Search Console to investigate whether or not hacked pages are the source of the unusual website
\n traffic.\n<\/p>\nTracking your site appearance in search results<\/h3>\n
\n Periodically checking how your site appears in search results is good practice for all webmasters.
\n It also allows you to spot symptoms of hacking. You can check your site in Google by using the
\nsite:<\/code> operator<\/a>
\n on your site (that is, search forsite:example.com<\/code>). If you see any gibberish links
\n associated with your site or a label that says “This site may be hacked.”, your site might have
\n been compromised.\n<\/p>\nSigning up for alerts from Google<\/h3>\n
\n We recommend you sign up for
\n Search Console<\/a>. In Search
\n Console, you can check if Google has detected any hacked pages on your site by looking in the
\n Manual Actions Viewer<\/a>
\n ou
\n Security Issues<\/a>
\n report. Search Console will also message you if Google has detected any hacked pages on your site.\n<\/p>\n\n Also, we recommend you set up
\n Google Alerts<\/a> for your site. Google Alerts
\n will email you if Google finds new results for a search query. For example, you can set up a
\n Google Alert for your site in conjunction with
\n common spammy terms<\/span><\/a>
\n like site:example.com cheap software<\/span>. If you receive an email that
\n Google has returned a new query for that term, you should immediately check what pages on your
\n site are triggering that alert.\n<\/p>\nDiagnosing your Site<\/h2>\n
Gathering tools that can help<\/h3>\n
\n In Search Console, you have access to the
\n Fetch as Google tool<\/a>
\n in Search Console. The Fetch as Google tool allows you to see a page as Google sees it. This will
\n help you to identify cloaked hacked pages. Additional tools from others are listed in the appendix
\n to this post.\n<\/p>\nChecking for hacked pages<\/h3>\n
\n If you’re not sure if there is hacked content on your site, the
\n Google Hacked Troubleshooter<\/a>
\n can walk you through some basic checks. For this type of hack, you’ll want to perform a
\nsite:<\/code> search on your site. Look for suspicious pages and URLs loaded with strange
\n keywords in the search results. If you have a large number of pages on your site, you might need
\n to try a more targeted query.
\n Find common spam terms<\/a>
\n and append them to yoursite:<\/code> search query like
\nsite:example.com cheap software<\/code>. Try this with several spammy terms to see if any
\n results show up.\n<\/p>\nChecking for cloaking on hacked pages<\/h3>\n
\n Because this type of hacking employs cloaking to prevent accurate detection, it’s very important
\n that you use the Fetch as Google tool in Search Console to check the spammy pages you found in the
\n previous step. Remember, cloaked pages can show you an HTTP404<\/code> page that tricks you
\n into thinking the hack is fixed even if the page is still live. You should also use Fetch as
\n Google on your home page as well. This type of hack often adds text or links to the home page.\n<\/p>\n\n We hope this post has given you a better idea of how to identify and diagnose hacks that inject
\n gibberish URLs on your site. Tune in next week where we’ll be explaining how to remove this hack
\n from your site. Be sure to follow our social campaigns and share any tips or tricks you might have
\n about staying safe on the web with the #NoHacked hashtag.\n<\/p>\n\n If you have any additional questions, you can post in the
\n Webmaster Help Forums<\/a>
\n where a community of webmasters can help answer your questions. You can also join our
\n Hangout on Air about Security<\/a>
\n on August 26.\n<\/p>\nAppendix<\/h2>\n
\n These are tools that scan your site and may be able to find problematic content. Other than
\n VirusTotal, Google doesn’t run or support them:
\n Virus Total<\/a>,
\n Aw-snap.info<\/a>,
\n Sucuri Site Check<\/a>,
\n Wepawet<\/a>. These are tools that may be
\n able to scan your site for problematic content. Keep in mind that these scanners can’t guarantee
\n that they will identify every type of problematic content.\n<\/p>\nMonday, August 17, 2015 Today in our #NoHacked campaign, we’ll be discussing how to identify and diagnose a trending hack. Even if your site is not infected with this specific type of hack, many of these steps can be helpful for other types of hacks. Next week, we’ll be following up with a post about […]<\/p>\n","protected":false},"menu_order":83336,"template":"","meta":{"footnotes":""},"ar_kb_kategori":[665],"ar_kb_etiket":[],"class_list":["post-24897","ar_kb","type-ar_kb","status-publish","has-post-thumbnail","hentry","ar_kb_kategori-blog"],"_links":{"self":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb\/24897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb"}],"about":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/types\/ar_kb"}],"version-history":[{"count":0,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb\/24897\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/media\/27079"}],"wp:attachment":[{"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/media?parent=24897"}],"wp:term":[{"taxonomy":"ar_kb_kategori","embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb_kategori?post=24897"},{"taxonomy":"ar_kb_etiket","embeddable":true,"href":"https:\/\/alienroad.com\/wp-json\/wp\/v2\/ar_kb_etiket?post=24897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- \n Checking for hacked pages<\/a>\n <\/li>\n
- \n Tracking your site appearance in search results<\/a>\n <\/li>\n
- \n Cloaking<\/a>\n <\/li>\n<\/ul>\n<\/li>\n
- \n Gibberish pages<\/a>\n <\/li>\n