All posts are in italics (since New Year)

Also check your users. I was hacked too and they created a new admin account.

True but at least there’s some helpful info in my post.

Just giving out a dozen links and saying call your hosting provider is too generic.

Yep – I did check the users (there were no new ones) but I still modified each existing login. Thanks for that suggestion, egexperiment626.

Just giving out a dozen links and saying call your hosting provider is too generic.

Every one of the pages I linked to gives very specific step-by-step advice on how to de-louse your site after a hack. What else were you expecting? There’s no magic bullet in these kinds of situations. Just a lot of very careful cleaning up to do.

As for calling your hosts, had it not occurred to you that there might be a security issue with your server? Informing your hosts seems, to me, to be the right thing to do in these cases as it allows them to opportunity to check for issues at their end. As it stands, we’ve seen quite a few of these hacks on GoDaddy sites over the past day or two, so there’s a distinct possibility that there is a server problem here. At least give your host the chance to look into it.

I just wish you would have opened with that body tag note. As soon as you said that, we found the prob. Opening with that long list just flusters a person.

I did call GoDaddy as suggested. They investigated the htaccess file and the account. Eventually the account/ftp login was changed.

However, they did not have any specifics for me though on how to remove that javascript function from the WordPress theme. Someone on Twitter gave me a suggestion on where to look for starters (which would have been nice to have found here).

At least now when others search this forum, they’ll find this thread and this exchange.

Your “I checked the source and body tag…” reply up was perfect. I am truly grateful for that note.

It didn’t occur to me to check the page source and search for that. I kept looking at the posts themselves which was pointless as the hack was in the WordPress header.php theme itself.

So again, you eventually had a super helpful reply but the opening generic note just flusters/overwhelms a non-IT person ??

As soon as you said that, we found the prob.

No. You cured the symptom. Without a proper investigation, the original problem remains.

they did not have any specifics for me though on how to remove that javascript function from the WordPress theme

Every hack is different. We cannot provide you with those kinds of specifics unless we happen to have examined an identically hacked site at length ourselves. If you want that level of specifics, you need to look at hiring someone like the folks over at https://sucuri.net/

This is a free, volunteer-staffed forum. We don’t do the work for you. We try to help you earn to help yourself.

I totally get the free help/community side. I wasn’t asking anyone to do the work for me. It was just nice to get the more specific note.

You’re not following me on my point so we’ll just leave it at that since this back and forth bores and doesn’t help anyone else.

The good news is that in the future, someone can search this thread and see that if their site font suddenly changes…well maybe they can now search for the tag you shared. If they find that hidden java function, they can then try the fix I used. A win-win for the next person at least.