Hacked site? Strange text in header

There have been several other posts lately with that same hack… the usual steps apply:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
https://codex.www.ads-software.com/Hardening_WordPress
https://www.studiopress.com/tips/wordpress-site-security.htm

I have the exact same issue today..hosted on godaddy

Aw, sorry to hear that – it seems to be a lot of people. Use the resources above and insist that they help you and/or give you a credit. You might also want to consider changing hosts.

Thank you.I was curious,were these issue had godaddy as common hosting denominator?i am seriously considering to change the host.Please suggest me some good hosts by experience.

So far as I understand it, some of their servers got hacked — so then the sites on the servers were also hacked. But I really don’t know anything for sure or in detail. But they do seem to have a lot of problems and unhappy customers – just based on what I’ve seen here.

I know all of the hosts on this page: https://www.ads-software.com/hosting/
are good and support WP well. You could go to their sites and see what you think.

See this post for possible help!

Theme files hacked, link added after body tag

Im not a Godaddy fan, even tho I have several domains there, but I have this problem too.
Like said above, it could be a plug-in that got added that allowed then insert of the code.
I had this problem about 1 month ago, with several sites mentioned in the hacked area, not just the loan links.

I do SEO, and my software that checks my coding is what found it, oddly enough. So I went digging in my WP editor area, and went one template at a time and searched for the word “loan”. I dont remember which template I found it in back then, but just now I found it in the header.php and saw there were several domains hidden in there, not all about loans, when I was just looking for favao diet

I copied one domain and pasted it into a browser to see the site and who the owner might be to track it, but got a 404 page error. So maybe they got found out, and had to cancel their site.
To clean it, I was able to delete (and this is just what I did, it worked, but you need to know some html and be safe), I deleted the code including from <div> to the end of it </div> and all the loan referenced and any other domains found in that area.

It was in the Twenty Eleven theme, but I cant say it was because of the Twenty Eleven theme, it could have been a plugin, but I only have a couple of plugins, so I dont know where it came from, but its gone now.

is there anyway, or any sort of plugin, that will automatically find these sorts of issues?

i was very very lucky to have stumbled upon it. i just happened to be looking at the code for something else right there. but its very rare that i’m looking that closely at the code. and if this appeared somewhere else in the code, and not towards the top of each page, i would have never seen it.

so i’m hoping for some way to be alerted that its there as soon as it appears.

any ideas? thanks in advance.

I use a plugin called WordFence, which can be set to notify of any changes to the core files, plugins, and themes. I’ve also used Sucuri Security – SiteCheck Malware Scanner, which you can use for a manual scan of the site. The Sucuri plugin also provides some hardening features which are useful.

Hope this helps!

Emily

My header file had been hacked 4-5 times over the last 6 months with Canadian pharmacy content “Buy Levitra / Viagra Online”, etc.

I would always DELETE the bad code, then a few months later, it “appeared” again.

Per Emily’s suggestion, I installed the plugin called WordFence, ran a Scan,
and it found the malicious script code hidden in my database as –

wp-admin/images/media-range-saturnine.php

(all other files were images, this was the only script)

Steps taken:
– Allowed WordFence to DELETE the bad code
– Signed into GoDaddy / Control Pane/ FTP File Manager to ‘Edit’ and verify the ‘Critical’ issue was resolved, and the malicious code was gone.
– Ran Scan again, it was “clean” with no issues
– Changed my WordPress, and Database PWs

I have researched this error for months, and have seen many comments & concerns with GoDaddy hosting. I know there was a world-wide brute force attack on WordPress a few months ago, and some GoDaddy servers may have been compromised.

Does anyone have any better hosting recommendations? I’m thinking I need to host my site elsewhere.

Hope I can save someone else the pain I experienced, and that Wordfence will catch any unauthorized code changes going forward.

Thanks for the tip Emily.

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html