Website cleanup service needed

Forums › IT Pro and developers › Website cleanup service needed

1101

3121 posts

Uber Geek

#259905 29-Oct-2019 16:49

Wordpress :-(
I have a client with a neglected website in need of a professional cleanup
Ive tried Wordfence & Quttera scan tools from within wordpress . Ive also tried external scan tools

Google Search Console shows it has "Hacked:URL injection" & gives examples of spammy urls on the website
These hacked urls are hidden it seems, you cant brose to them & the Web scan tools Ive tried dont find them.

So , Im after recommendations of a Site Cleaning Service I can recommend to the owners , a service that can dig in at a lower level & wont rely on just a scan tool
The website was hacked & cleaned in the past . Its still has issues that google doesnt like , so a google search will show as "this site may be hacked" , because of those
hidden spammy links (hacked URL injection)

Cheers

1 | 2

3603 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2345948 29-Oct-2019 17:33

Have you tried downloading the whole site, and database then doing a keyword search across the whole thing?

Of course I would assume there are no backups?

And if it's a basic site is it easier to just rebuild from scratch if you download any important static content.

marpada

474 posts

Ultimate Geek

#2345965 29-Oct-2019 18:43

I cleaned dozens of sites back in the day. The most sophisticated ones will use every trick on the book to hide from prying eyes, like sending different response depending on the client's user agent and ofuscating the code. What it works best in my experience is search the php code and look for functions commonly used to hide code like eval() and base64_decode() .

This posts has some sensible tips to clean a site https://www.wpwhitesecurity.com/clean-hacked-wordpress-website-blog/

timmmay

20512 posts

Uber Geek

Trusted

Lifetime subscriber

#2346022 29-Oct-2019 19:39

Can you just install Wordpress and the plugins fresh, and restore the DB?

mattwnz

20111 posts

Uber Geek

#2346025 29-Oct-2019 19:47

Guessing it is all riddled through the database, as well in files. The problem is that many people get these wordpress websites setup, perhaps by a friend, but then doesn't keep it all updated with the latest plugins etc. So sometimes the best solution is to start again. I am becoming more and more of a fan of SaaS websites for regular brouchure type websites, as you then don't have to worry about keeping it up to date, or keeping regular backups. Wordpress can be quite expensive, if you are doing everything correctly, using third party services for backup, security, etc, and want a fast quick secure website.. But i do use wordpress for my own website. It is easy to setup, but it can be a frustrating over time when things need updating and when things go wrong.

1101

3121 posts

Uber Geek

#2346168 30-Oct-2019 09:20

Ive now run several WordPress malware scan plugins, none found the infections.
So , Im yet to find a cleaning program that will even detect the issues

Its one of those sites where it wasnt ever maintained or kept up to date with WP updates . I doubt there will be a clean backup to restore from.
It may need to be examined line by line ?
A rebuild from scratch may be the way to go .

sidefx

3706 posts

Uber Geek

Trusted

#2346218 30-Oct-2019 10:38

1101:

Google Search Console shows it has "Hacked:URL injection" & gives examples of spammy urls on the website
These hacked urls are hidden it seems, you cant brose to them & the Web scan tools Ive tried dont find them.

What is the site? Google spider must be crawling to them somehow?

"I was born not knowing and have had only a little time to change that here and there." | Octopus Energy | Sharesies
- Richard Feynman

irpegg

140 posts

Master Geek

#2346234 30-Oct-2019 10:58

Try reach out to your hosting provider, they may have tools for this situation like Sitelock, immunify360 etc

Backblaze

Backblaze Unlimited Backup. World’s easiest cloud backup. Get peace of mind knowing your files are backed up securely in the cloud (affiliate link).

1101

3121 posts

Uber Geek

#2346269 30-Oct-2019 12:09

timbee:

Try reach out to your hosting provider, they may have tools for this situation like Sitelock, immunify360 etc

Been there, done that. They had a look, claimed they cleaned some infections . Its still showing as infected in the Google Search Console .
They suggested "Protection Power CDN " to protect the website. These tools dont seem to find the issues .

MurrayM

2449 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2346280 30-Oct-2019 12:52

And Search Console doesn't give you any more information, eg telling you which files it thinks are infected?

mattwnz

20111 posts

Uber Geek

#2346301 30-Oct-2019 13:39

Are they not using some form of wordpress security plugin Wordfence?

Delphinus

611 posts

Ultimate Geek

#2346310 30-Oct-2019 14:07

I've also had some success downloading the website then running your local antivirus tool (eg NOD32) through it. Often picks up a few infected files.

1101

3121 posts

Uber Geek

#2346619 31-Oct-2019 08:51

They didnt have any security plugins. I installed wordfence, It cont find the infections

The infections arnt files , they are "Hacked URL Injections"
Google search console gives the injected urls, but no search can find them.

BarTender

3603 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2346631 31-Oct-2019 09:48

I suspect they have source based requests, or google has outdated information. Have you asked Google to re-index your site? https://support.google.com/webmasters/answer/6065812?hl=en

1101

3121 posts

Uber Geek

#2346646 31-Oct-2019 10:27

BarTender:

Have you asked Google to re-index your site? https://support.google.com/webmasters/answer/6065812?hl=en

Yes, more than once .
Google also gives dates these issues where detected : redetected after re-index .

freitasm

BDFL - Memuneh
79158 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2346651 31-Oct-2019 10:39

I feel you. I know of a cafe in Wellington with an infected site. The site shows a scam page - but only on the first visit coming from Google search. If you go directly to the site nothing happens.

I've reported to the owner via Contact Us page, reported to CERT NZ... Still there, after nine months.

Search Automat Wellington.

1 | 2