Moe

@lubos55 Unfortunately, Some website security scanners as well as some antivirus products are still reporting live malware on your website. I’ve tested it and still see redirecting to livedashboard and other malicious websites.

Maybe it was used previously by you or your developer/webmaster. If you have other valid backups for your site then you can safely remove this folder if you want.

The old folder updraft/themes-old/ is associated with your updraft plugin. Check the exact malware warning or check the content of this folder as it may contain malicious/suspicious files.

@androidandreas Your website is still infected with SEO spam as you can see in this screenshot https://snipboard.io/MJ8CiY.jpg . You may need to search your db/files for it first hopefully you can find and remove it and it may be encoded or hidden somewhere else in any files or any db entries. so a full check may be needed.

It seems to be associated with the Real Cookie Banner plugin, Do you recognize or use it on your website or anything from devowl?

: AH01276: Cannot serve directory /home/name/public_html/wp-content/uploads/: No matching DirectoryIndex

This error means that there is no index file inside your uploads folder so you can try to create/upload an empty index.php inside it and see if that works.

Also, Do you have any options flag in your .htaccess file? Whether the main one under public_html or the one in your uploads folder? Probably a security plugin added this for hardening or it’s a global webserver config to prevent directory listing for security reasons.

Hello

We use master-slave or master-master replication setup for such huge websites so this is something that you may consider. Your server admin should be able to set it up for you.

@algisj The spammy links are created by a malicious code injected in one of your files or in your db entries. It may be due to spammy .htaccess rewrite rules as well so this is a good start point to search and check your .htaccess files and try replacing the core WP folders (wp-admin & wp-includes) using a clean & fresh copy of WP and check the timestamps of your wp-content files & folders, Compare it to clean copies to determine if something there is causing this.

Unfortunately, Your website seems to be infected by the Japanese SEO Spam hack. It’s trying to hide it and make it stealthy as long as possible that’s why it’s triggered when visited using specific useragents only.

An example of this SEO spam injection, this link, Remove the brackets and try to visit it? Your antivirus will just warn you about something malicious and you will get instantly redirected to .jp and .top malicious websites.

neurologica[.]ai/goods/suspect101466235?id=6281

Here is a screenshot of the shown seo spam when visited using google bot useragent https://snipboard.io/iyTG2k.jpg

Here is a guide that may help fixing it https://web.dev/articles/fix-the-japanese-keyword-hack