Site was Hacked, Hidden Links and Pages installed

  • I have updated some vulnerable plugins, and added increased security, but there appear to be a ton of links or urls that were left behind.

    I am seeing activity for impressions in Webmaster Tools, but I can’t find the pages that are referenced there.

    They all end in things like /forex-dhe-binary-options/

    All have the ‘binary-options’ in the URL. Any way to find this malicious code installation in my site files?

Viewing 2 replies - 1 through 2 (of 2 total)

  • I am sorry to hear your site is damaged. Do you or your hosting company have a full backup of your site? The fastest and most sure way to repair your site is to restore from a backup made before the hack.

    Without a backup your only solution is to repair the site. Follow this guide.

    When you’re done, you may want to implement some (if not all) of the recommended security measures.

    Hi gmichael7,

    did you manage to solve this?
    I got affected as well.

    I had the same problem and was able to fix this.
    Issue here is your theme was hacked.
    If you look at the wp_posts table you could see post with post_author = 0 (see also post_content or post_title like ‘%binary%’ or post_title like ‘%trading%’ or post_title like’%option’% So I suggest delete these entries first.
    delete from wp_post where post_author = 0;

    Only bots(googlebots, bingbots) can see these posts, you can see in your wordfence live stats that when bots index these pages it creates an entry in your wp_posts table.

    Go to you theme folder search for functions.php, look at the bottom an check is you can see a line with base64… delete this line.

    Go to google webmastertool and apply for security check. Google will remove the “this site might be hacked” in a couple of days.
    delete remaining entries in wp_post delete from wp_post where post_author = 0;

    also posted in reddit

    WordPress hacked with URL injection.how do I clean it?
    by inWordPress

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Site was Hacked, Hidden Links and Pages installed’ is closed to new replies.