1 jili slot login,Win jili app.Recharge Every day and Get Bonus up-to 50%!

siteoptimized
(@siteoptimized)

10 years ago

Our website just picked up a “lovely” link to a phrama product under the header: https://www.sophiaskiles.com/ Anyone know how I can get rid of it? Sucuri says my site is fine but.. well we don’t see drugs..

Viewing 11 replies - 1 through 11 (of 11 total)

bestrandom
(@bestrandom)

10 years ago

Check it with isithacked.com and you will get more details.

I have similar observation on my site just instead of phrama products I had new pages linking to betting-the-kentucky-derby-online or blackjack-en-ligne-mac

Lets hope someone comes to our rescue.

ultimat1
(@ultimat1)

10 years ago

Looks like your theme was hacked. You will need to check the theme files to find the link. I’d imagine it’s probably in the header.php file. I’d also recommend switching themes or having an expert look at the one you’re currently using as it seems to have an exploit somewhere. If you purchased the theme, let the developer know what happened. Unless you are using an old version of WP, in which case I’d update it immediately.

WPyogi
(@wpyogi)

10 years ago

See:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
https://codex.www.ads-software.com/Hardening_WordPress
https://www.studiopress.com/tips/wordpress-site-security.htm

BTW, this (Hacks) forum is NOT for hacked sites – it’s for hacking code discussions so moving this thread out to the appropriate forum.

Thread Starter siteoptimized
(@siteoptimized)

10 years ago

So isithacked.com says I am clean (which we know isn’t true) and there was nothing in any of the theme files.

Anyone else?

WPyogi
(@wpyogi)

10 years ago

Go through all of those resources above. Hacks can be very hard to clean up. There are no quick and easy fixes unless you or your host have a backup of your site from before it was hacked.
ultimat1
(@ultimat1)

10 years ago
Hmmm. Considering where it’s displaying (between the logo and menu) I would think it HAS to be in header.php of your theme. In your header.php file, look for this code:
```
<body <?php body_class(); ?>>
	<div id="container">
		<header id="main-header" class="clearfix">
			<h1 id="logo">
				<a href="<?php echo esc_url( home_url( '/' ) ); ?>"><?php bloginfo( 'name' ); ?></a>
			</h1>
			<nav id="top-menu">
			<?php
				wp_nav_menu( array(
					'theme_location' => 'primary-menu',
					'container'      => '',
					'fallback_cb'    => '',
					'menu_class'     => 'nav',
					'echo'           => true,
				) ); ?>
			</nav>
```
Should be around line 24 of the file. Unless you have altered this theme, your code should match what I have above exactly… if it doesn’t, then it’s definitely been altered by a hacker.
ultimat1
(@ultimat1)

10 years ago

Or you can always just reinstall the original theme that you are using (again providing you haven’t made modifications to the theme files that you need). You can get a fresh copy of your theme here: https://www.elegantthemes.com/gallery/serene/

WPyogi
(@wpyogi)

10 years ago

And just removing that code will not prevent it from happening again – which is very likely to happen if it’s not fully cleaned up and secured.

ultimat1
(@ultimat1)

10 years ago

Very true WPyogi. Highly recommend finding another theme that works for your site.

WPyogi
(@wpyogi)

10 years ago

Why are you assuming that the theme was the cause of the hack? That’s not a good assumption at all.

barnez
(@pidengmor)

10 years ago

WPyogi is spot on. The hack code might be found in the header, but the backdoor entry to the site could be anywhere: plugins/theme/compromised login credentials/compromised server. There are only three options available in the case of a hacked site:

1. Work through the resources linked to by WPyogi in comment 4 above
2. Delete and restore all site files to a known clean version pre-hack
3. Seek professional help

Removing one visible piece of hacked code and hoping for the best is not a solution and will likely lead to reinfection, damage to reputation among clients and blacklisting by search engines.