Database hacked – what do I look for

  • cellobella

    (@cellobella)


    17 years ago

    The database of my website – https://redsultana.com – has been hacked I think. (View source and check the list of nasties at the end)

    I’ve since put a clean install of 2.3.1, changed the password of both my database, and WordPress. As the links still appeared I assume there is something in the database.

    I’ve looked and searched but I’m really not sure what to search for. Would there be a string I could type in the search function?

    Any clues would be welcome.

Viewing 1 replies (of 1 total)
  • Thread Starter cellobella

    (@cellobella)

    Okay… could I be getting closer…

    First of all I deleted my galleries page and discovered that the number of links drastically reduced in number.

    Then, I’ve found in the rewrite_rules in wp_options of the database the entry below.

    When I delete it – next time I open the file – it’s back.

    Which suggests I think that somewhere else there is maybe a bit of nasty code…

    Any thoughts?

Viewing 1 replies (of 1 total)
  • The topic ‘Database hacked – what do I look for’ is closed to new replies.

Tags