Spam links posted in my Wordpress blog posts

Update: I have now accessed my site database via the CPanel, and removed the spam javascript.
I have also changed the database user, and new db user has new password.

I have also changed some other passwords.

However, I am still left wondering how they got into the website? ... Also, if you have any suggestions as to how to prevent this from happening again, I'd be grateful for your feedback.

Might be worth using the WordPress export plugin for all content, exporting theme settings and then doing a re-install. Did you purchase the theme or is it a potentially dodgy download?

This is because you use nulled theme, that's for sure.

Thank you Arta ... I will read through the links and report back.

Maybe you are using a hacked premium theme or plugin

Use Akismet Anti-Spam to avoid spammy links in your WordPress blog

Use anti-Spam software or Plugin to avoid Spam user and link form your Blog

I closed comments - after getting 11,000 legit ones - to avoid this spammy silliness

PS: I notice in the browser address bar, it says Not Secure left of the URL. I assume this just means I don't have SSL.

Update: I have installed plugin Easy Updates Manager, and set it to not allow any updates from themes or plugins.

Hi there,

Google released a new disavow tool. Just create a .txt file on your computer, add all DOMAINS (not all links) in the file and upload it to the Disavow tool here.

Perhaps add a captcha to the comment submission form.

You can download a wordpress security scanner to remove malware and other issues then you can use a plugin that only allows users to authenticate there comments.

Welp, that's terrifying.

I'm glad you got it taken care of. Some people are just jerks.

In this case, you can remove all spammy links from your blog spots. If you don't do this then your blog spot may lose ranking from google search engine.

I did some research about this so far called "Virus". I managed to find an infected plugin and installed it on a test wordpress install.

In fact it is an advertising malware that is found in nulled themes and plugins. The scenario is that you download a theme or a plugin that is already infected by a javascript malware that redirect the first time users from your website to their desired destination, where they then redirect the traffic.

Junk traffic, I wonder how does this add value to their cause!!

The malware looks like this: Screenshot
Since this is a javascript malware, it is added at the top of .js files in your theme or plugin.

I discovered it by Imunify, a cPanel antivirus that can be accessed via root level users on the server. So if you are unsure about how to identify it the problem, ask you hosting provider to run a scan for you. Don't be surprised if the hosting did not honor your request as you are 100% responsible for what's hosted on your account.

Steps to confirm the existence of this virus:
This virus is new and unknown to many antiviruses and since it is based on javascript, its hard for security tools to detect them so you need to do some manual work here.

1- Use incognito in browser
Try visiting your website in incognito mode. This way you will know if your website traffic is being redirected.

2- Run a Scan via a third-party
Use SiteChek by Sucuri to see if you are infected.

3- Install a Security Plugin
Among all, the best is to Install Sucuri Wordpress Plugin for a quick scan.

4- Search locally
Download a full copy of your website as an archive file on your computer and then try searching in that folder for the phrase "var _0x44tbc1" or "eval" (this text is a part of the malware code so if it exists, the search will lead to results with files that are infected)

What to do if you found out that you are infected
You are at your own mercy, there is no quick way to bulk edit these files unless you have the right tools. What I did was, I downloaded all the files on my computer, install Sublime and by the help of the article Search and Replace -- Multiple Files

Basically, I opened all the js files in Sublime, then using the article mentioned above, I told the sublime, wherever you find this text (Screenshot), replace it with nothing. This way it removes the javascript malware from the file. Then saved the file and uploaded it back.

IMPORTANT: The permission for the infected files are set to 0777 by the infector, you must set the correct file permissions for your wordpress install. 0644 for files and 0755 for folders.

If you are familiar with SSH, you can run the following commands:
find . -type d -print0 | xargs -0 chmod 0755 # For directories
find . -type f -print0 | xargs -0 chmod 0644 # For files

Good luck.

WordPress contains lots of spamm

I have exactly the same issue

It seems your site has been infected with a virus. There are many things that could cause this, but the most common is via the plugins. We had a similar experience before with our site and using an anti-malware plugin resolved the issue.

You need "All In One WP Security" and that's all you'll ever need. Seriously!

Finally heard back from Hostgator. This is what they said:

https://www.screencast.com/t/fnAmQXHRr

i don't know how to fix your problem but may help is installing a FACEBOOK plugin "WpDevArt Facebook comments" for your comments. everyone that post a comment on your site will have sign in with their facebook profile and most spammers like to stay anonymous. This will Limit the number of spammer on your site.

Hello!

There is a plugin called Askimet Anti-Spam and its free. It has a database of spam which is updated constantly, and so it is very effective in filtering out comments that are spammy.

Another thing you can do is to enable comment moderation by going to Settings >> Discussion, and check the "Comment must be manually approved" option.

The last thing I can suggest is to move to a new comment system such as Disqus. Disqus only allows comments from users who are logged in and they also moderate users that shows spammy activities.

Hope this helps.

Hi Toby,

I had to clean up several websites for a client that was recently infected with the same virus. There is no plugin that will fix it. You have a few basic choices:
1. Manual Track down and remove/replace/repair:

• Locate & remove the original infected file with executable payload.
• Repair altered directory security permissions set to the unsafe 777.
• Remove all infected plugins
• Remove virus injected code snippets from all pages and posts stored within your database.
• Download, install, and activate a safe temporary Wordpress theme (Twenty Eighteen)
• Re-install Wordpress core files through admin panel
• Re-install & reconfigure your previous Wordpress Theme.

2. Restore a previous backup of your website prior to infection (if available).

Or

3. Remove entire website and re-build from scratch.

The easiest option is number 2 but only available if you have an untainted backup available.

Option number 1 can be done if you know how to manage directory permissions, and know how to identify malicious code and remove from files and databases using find & replace techniques. If you miss anything infected file, code snippet, or database entry you website will still be compromised.

Short of those to options the only same way to remove this particular virus is to wipe all website files and rebuild from scratch. You need to figure out which options are within your purview and decide from there. You can always hire someone to remove the infection, though it may be an expensive undertaking.

HTH,

Don Burk

TAC is a plugin that will scan your theme's files to look for any malicious code. Sucuri has a WordPress plugin in both a free and premium version. It does a good job of checking all your core files to help identify any potential malicious code. If you're running a business that relies on your site.

I hope this will help you..

use can remove all the spam backlinks using disavow techniques.

This is only because you utilize.

according to the screenshot the code is in the post table, made by user id 1. am no expert, but looks like there is either a malicious plugin or code snippet in the theme or the admin login is compromised. clean the hosting account, change all passwords to ubersecure also on your hosting account, ftp and ssh, if possible add 2fa, check the log files to see who is accessing what and act on that, start with a fresh installation and secure it properly.

I will read through the links and report back.

hmmm, it is a controversial question

If you run wordpress sites, you ABSOLUTELY need to use a security plugin and update all your plugins, themes and wordress itself FREQUENTLY. Wordpress sites are heavily targeted by spammers and hackers because it is the most widely used CMS. I learned this the hard way and I will never use wordpress without a security plugin ever again. It's the first plugin I install on any new install.



I recommend WP Cerber Security Plugin because it offers a lot more than WordFence and is highly rated. One thing I like is that it allows you to easily insert reCAPTCHA on all your forms (login, forgotten password, comments, etc).



When you install a security plugin (any of them) and view the live traffic, you will be amazed at how many bots are trying to access and login to your admin area and accessing other WP files. Sometimes you can even see that some bots are fishing for certain plugins or themes that are known to have security holes. It's a real eye opener. The internet is basically a bot and hacker highway. If you don't have security on your site, you're asking for problems.


Never install a plugin or a theme that isn't frequently updated. Look at the changelog before you install. If it hasn't been update for a year or longer, forget it. The developer isn't active enough and you risk security problems, not to mention it may eventually break your site as wordpress gets updated.


On the other hand, if you are using nulled (pirated) themes and plugins, well, you're on your own.

Mostly WordPress websites are being hacked due to Null themes and outdated plugins, that is what you need to make sure if any of such issue is there, keep updating all the installed plugin and themes as well. once you have done this you are almost secure with your wordpress website.

also note that once hacker is in your website he will leave lots of place with their shell script of other tools to get again even you have updated all the above. so try to find any non relevant folders and files in the file manager and remove it.

Hope that answer your questions and concerns .

1. Install Disqus commenting system that replaces the standard WP spam-able commenting system.
2. Spam links are easily managed in the Comments from the dashboard from where you can delete them in bulk.

I have experienced links being added to my answer in forums but not on my blog. This is really infuriating though. But I am glad that you found a way to remove it. Now I know how to do it if links get added to my blog, too. Thanks!

Use Anti Spam Bee plugin (no cost) to avoid spammy comments in your WordPress blog.

I had the same problem in the past, it was due mainly to bad file permissions. Depending on your Apache and PHP configuration, you the owner of the files should be only the account for that specific blog.

I also recommend installing Wordfence, it does a pretty good job in securing your blog. The free version is not updated daily but still, it adds a strong layer of protection.

Use the anti-spam WordPress plugins such as:
-Akismet
-Anti-Spam by CleanTalk--No Captcha, No Comments & Registrations Spam
-WangGuard
-Anti-Spam Bee
-WordPress Zero Spam
-Growmap Anti Spambot Plugin
-WPBruiser {No Captcha Anti-Spam}
-Stop Spammers Spam Prevention

I wish you good luck!

1. You must secure your site. first of all don't install any plugin and theme that is not reputed or trusted. Some time hackers put a hidden shel to your site and sometime they put some harmful code that stills your vital server information. So before you install anything to your site make sure it is clean or only install reputed plugins or themes.
2. Make regular backup of your database and the uploads folder so if any major damage happens you can recover it quickly.
3. As other mentions change your file permitions as they mensioned.
4. Protect your admin area by adding password protection to wp-admin folder in cpanel.
5. use popular anti spamming plugins for blocking spam comments.
6. Finally read this article https://codex.wordpress.org/Hardening_WordPress to increase the security of your site.

i think one of your plugin was affected with bad script which cause your site to behave abnormal

Try to change the database. And also try to remove javascript.

I'm using Akismet for wordpress and it's working good

I think you are using nulled theme. There are many wordpress theme validation plugins available that you can try to check errors of your theme.

Hi, Toby.
You need to harden your website security. To know how to do it, you may visit the WP Beginner website. You will find a lot of useful tips for any issues that beginners face.

Why not reinstall your wordpress site while adding necessary but reliable plugins; some times these kinds of injected scripts reappear after some time.

I'm still facing this problem. I installed spam protection plugins. But the problem is they only filter the comments. Later I have to delete manually. Does anybody have a better solution?
Thank you.