How to check your site for base64 links

[How to check your site for base64 links]

This is a quick way to check your site for hidden base64 links, which are used by link spammers. There's multiple ways to check a live site for hidden links, this technique is one of the faster ways to check a Wordpress theme.

This assumes your not technically challenged. If you need individual help checking your own files, hire someone to help you, tell them to read the instructions below.



Step #1

Get a copy of your Wordpress theme onto your offline desktop, you can use something like Filezilla (free FTP).



Step #2

We need a way to search the entire Wordpress theme (including any theme sub-folders), we'll use Notepad++ (free text editor).



Step #3

With the Wordpress theme on your desktop, open Notepad++, go to Search --> Find, you'll get a popup window search box.

Click the Find in Files tab on the search box popup window.

Here's my settings inside the Notepad++ search box:




What this does is scan the entire WP theme including any sub-folders, then list each instance of the keyword base that is found inside the theme template files & displays the line-number where the keyword was found. This takes only a few seconds to scan the entire Wordpress theme.

You can also use this for searching for the keyword http, to verify all the regular links are legit links inside the Wordpress theme.

This will work for any type of CMS (Joomla, Drupal, Wordpress, etc...), even bulk plain HTML files/folders. If you can get your files on your offline desktop, you scan for hidden links.






How do I know what hidden links look like?

The base64 links usually only show up in the Google Cache (text version), not in the live web page HTML, not in the full Google Cache.

Here's a screenshot of what base64 links can do to a web page (major link spam):







What should I do If my theme has hidden base64 links?

The first thing I would do is switch your theme back to the default theme that was included with your Wordpress install.

Next, delete the infected base64 theme from your live site.

Do not try & make edits to a live sites Wordpress theme that has base64 links, sometimes the base64 link code will make calls to multiple theme files so If the code on one template page is removed, the entire site will get locked up (trust me on this, I've had it happen), the only way back into the site is Cpanel, or If you know what your doing, FTP.




Is a Wordpress theme the only place base64 links might be hidden?

No, base64 links can also be hidden inside Wordpress plugins. Do the same search for the keyword base on all the plugin files (everything).

A Wordpress plugin can add links anyplace on your live web page, the base64 links do not have to be in (example) a header.php file to show up in the live web pages header.




How do I view the Google Cache (text version)?

You can view your Google Cache (text version) by adding cache: to the front of any URL, If a Google Cache exist, then you should see a link in the top/right side of the cache page (Text-only version).

Here's an example of the Warrior Forums Google cache (text version):
If for some reason you don't see a link to the text version of the Google cache, then add this to the end of the URL of the full Google cache URL:
The &strip=1 part of the URL is what triggers the text version of a Google cache.




How can I prevent base64 from ever getting on my new website?

The easiest way to prevent base64 links from ever getting on your live website to begin with is, simply download all Wordpress themes & Wordpress plugins to your offline desktop, then use the Notepad++ search function (above) to verify no base64 links exist inside of any files that will be installed on your live webpage.



Why do people add these base64 links to free Wordpress themes/plugins?

They're link spammers, that's what link spammers do, they find the easiest way to add links to any webpage. Wordpress powers approx. +14% of the worlds blogs, If even a small amount of that percentage is hit with base64 link spam, that's a huge amount of links. Remember, these base64 links are typically site-wide spam links, most Wordpress blogs have hundreds/thousands of pages per domain (massive amount of spam links).

Google is catching on to which sites have been hit with base64 links, this Google page mentions base64.




Can I search my live site/blog for base64 links?

You can manually search your live site/blog template files via your CMS Admin. panel, but it's very time consuming since there's so many files that need to be searched. If you miss one instance of the base64 link code, you could either still have the spam links on your site/blog, or worse, lock up your entire site (mentioned above). IMO, it's easier/faster to automate the base64 search while running Notepad++.




Is every instance of the keyword base a problem?

You might find that every instance of the keyword base isn't a problem, this is a generic search string instead of searching for example: base_64, base64, etc...

Use your own judgement for deciding which template code is actually base64 code. Here's what part of the base64 code might look like (random numbers/letters):
Since all themes are different & all themes have different theme authors, it's possible that some parts of a theme template page could be legitimately encrypted, example for verifying the user has a payed license code to actually use the theme.

My advice is, If you're running anything free, do a base64 search on the entire theme/plugin files/folders to be on the safe side.





Related Google links:

• New first stop for hacked site recovery
• Help for hacked sites
• Step 5: Assess the damage (spam) (mentions base64)