11 {{ upvoteCount | shortNum }}
11 {{ upvoteCount | shortNum }}

This site may be hacked... but it isn't!

by iVR4xx
9 replies
  • SEO
    • |
So I purchased an expiring domain about a month back. The domain was parked with sedo when I got it. I put my DNS details in, loaded wordpress and my unique content on it along with google analytics code.
A week or so later I google the web address and under it is written "this site may be hacked".
I then started a google webmasters tools account and verified my site. In security issues there are no issues to report, therefore no way to ask for reconsideration. I have submitted a site index.
It's been at least 2 weeks since the index was submitted but I can hardly see how this could be the issue anyway.

I have checked with isithacked .com and sucuri .com, both come up clean.

One thing i noted is that the site title when googled is still the last owners name and not my sites new title...

Any ideas on how to fix this would be greatly appreciated as I hardly want to do any SEO on this site before I fix the problem.
#hacked #site
  • Profile picture of the author Paz
    You probably might want to share the URL to get the best answer
    {{ DiscussionBoard.errors[10112421].message }}
  • Profile picture of the author yukon
    Banned
    Originally Posted by iVR4xx View Post

    So I purchased an expiring domain about a month back. The domain was parked with sedo when I got it. I put my DNS details in, loaded wordpress and my unique content on it along with google analytics code.
    A week or so later I google the web address and under it is written "this site may be hacked".
    I then started a google webmasters tools account and verified my site. In security issues there are no issues to report, therefore no way to ask for reconsideration. I have submitted a site index.
    It's been at least 2 weeks since the index was submitted but I can hardly see how this could be the issue anyway.

    I have checked with isithacked .com and sucuri .com, both come up clean.

    One thing i noted is that the site title when googled is still the last owners name and not my sites new title...

    Any ideas on how to fix this would be greatly appreciated as I hardly want to do any SEO on this site before I fix the problem.
    Most likely either a Wordpress theme or plugin problem.
    {{ DiscussionBoard.errors[10112443].message }}
  • Profile picture of the author Wage Mills
    you may have to change your websites template

    some or the wordpress themes come with viruses
    {{ DiscussionBoard.errors[10112456].message }}
  • Profile picture of the author fpforum
    Have you tried scanning the URL on VirusTotal? As others have said, it could be caused by a theme or plugin you installed when setting up Wordpress.
    Signature
    Free SEO Software - Start Improving Your Rankings Today!
    Windows VPS Servers - Cheap Windows VPS Servers With Instant Setup!
    {{ DiscussionBoard.errors[10113005].message }}
    • Profile picture of the author iVR4xx
      Originally Posted by Paz View Post

      You probably might want to share the URL to get the best answer
      I understand this would probably help but it's an affiliate site and I'm not willing to share at this stage.

      Originally Posted by yukon View Post

      Most likely either a Wordpress theme or plugin problem.
      Thanks for this tip. I followed the instructions at the link to check for base64 links and came up with only one. It's on line 16 in the Genericons.css file and looks something like this:

      url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAADM8AA0AAAAAUFQAAAAAAAAAAAAAA AAAAAAA/AAAAAQAAAAEAEQFEWdhc3AAADMYAAAACAAAAAj//wADZ2x5ZgAABBAAACvJAABC1JhKHWFoZWFkAAAB
      1w7shtEAVsEIvAAA),

      NOTE: I cut it down massively just to give an idea of what it looks like.
      I tried pasting the code into a Base64 translator and got no results in any decode language.

      Any ideas if this is suspect?



      Originally Posted by Wage Mills View Post

      you may have to change your websites template

      some or the wordpress themes come with viruses
      I did use a popular theme to try to avoid this problem. Shouldn't any viruses show up in the tests I've done so far?

      Originally Posted by fpforum View Post

      Have you tried scanning the URL on VirusTotal? As others have said, it could be caused by a theme or plugin you installed when setting up Wordpress.
      Thanks for the suggestion. I just scanned the URL and everything came up clean.

      In the meantime I have found this:
      The reply from Travler is what interests me

      https://productforums.google.com/for...rs/_igJQxBLLzg

      There are about 24 links that the old site had that no longer exist on the new site. From anyone's experience, could this have any impact?

      BTW, the plugins I have installed are all popular ones and are as follows:

      Akismet
      All In One SEO
      Contact Form Builder (not one I've used before but I already had the problem before I installed this plugin)
      Google XML Sitemaps
      Link Juice Keeper
      Redirection (for aff links)
      WP-Sticky
      WP Hide Post


      Thanks to all who have tried to help so far.
      {{ DiscussionBoard.errors[10114131].message }}
      • Profile picture of the author yukon
        Banned
        Originally Posted by iVR4xx View Post

        Thanks for this tip. I followed the instructions at the link to check for base64 links and came up with only one. It's on line 16 in the Genericons.css file and looks something like this:

        url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAADM8AA0AAAAAUFQAAAAAAAAAAAAAA AAAAAAA/AAAAAQAAAAEAEQFEWdhc3AAADMYAAAACAAAAAj//wADZ2x5ZgAABBAAACvJAABC1JhKHWFoZWFkAAAB
        1w7shtEAVsEIvAAA),

        NOTE: I cut it down massively just to give an idea of what it looks like.
        I tried pasting the code into a Base64 translator and got no results in any decode language.

        Any ideas if this is suspect?


        You'll need the entire base64 string to be able to decode (decode base64).

        Keep in mind it only takes a single instance of a problem base64 snippet to blast an entire CMS/Wordpress site with spam links (real base64 spam screenshot below).





        {{ DiscussionBoard.errors[10114159].message }}
        • Profile picture of the author iVR4xx
          Originally Posted by yukon View Post

          You'll need the entire base64 string to be able to decode (decode base64).

          Keep in mind it only takes a single instance of a problem base64 snippet to blast an entire CMS/Wordpress site with spam links (real base64 spam screenshot below).
          I understand this, I only cut down the code string for the purpose of posting here. It's a bit strange that I couldn't decode it though...

          Currently using a "popular enough" theme which when googled with the terms "this site may be hacked" returns no results.
          May have to change it anyway.
          {{ DiscussionBoard.errors[10114190].message }}
          • Profile picture of the author yukon
            Banned
            Originally Posted by iVR4xx View Post

            I understand this, I only cut down the code string for the purpose of posting here. It's a bit strange that I couldn't decode it though...

            Currently using a "popular enough" theme which when googled with the terms "this site may be hacked" returns no results.
            May have to change it anyway.
            Keep in mind If Google detected something on the old theme/plugin it might take a while to update the SERP listings & remove any warnings.

            Maybe try a Fetch as Google in Webmaster Tools after switching themes & then do a site:domain.com search from a browser with no history/cache (incognito) to see If there's still a SERP warning.

            Also check the Google cache (text version) of the warning page/URL, is there a bunch of spammy links (from base64)? It has to be the text version of the cache, not the full version.
            {{ DiscussionBoard.errors[10114226].message }}
  • Profile picture of the author iVR4xx
    Ok, pulling hair out now. Due to that Base64 I found in the old theme I decided it was best to change the theme. Did that, checked for Base64, no results, all clean.
    Fetched as google a month ago today and left the site think about its actions and come out when it's all good again.
    The problem? It's been sitting there for a month and still has the same error on google search results.

    The google cache has no history btw, as it's cache date was after the last site went and before my site was up.

    What the far out do I do now? Remove everything and start again?

    Help please!
    {{ DiscussionBoard.errors[10180879].message }}

Trending Topics