Website is re-directing to a dodgy site has it been hacked? How do i fix this?

Posted on March 21, 2019

I’m not that technical and can’t get hold of my developer. please help

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

jarland

March 21, 2019

Greetings!

I’m sorry about this, having a website compromised can be quite a frustrating thing to deal with. The first thing that you need to know is that you absolutely will need to dive into the server to fix this, there will be no substitute for this. This means that you either need to be familiar with Linux or you need to be willing/able to get familiar with it. The one thing I will not have handy is a tutorial that will certainly bridge the gap between current knowledge and the knowledge necessary to solve this problem. I do not know where you sit currently on that line, so I make no assumptions.

When dealing with a compromised website, I really enjoy the accepted and most upvoted answer here:

https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

Additionally, Wordpress has some great documentation for the situation:

https://codex.wordpress.org/FAQ_My_site_was_hacked

I’ve also written up my recommendation in the past, for dealing with compromised Wordpress sites. I will paste it here for your benefit:

You’ll have to go through your files one by one to find the malicious code. The proper way to deal with this is to take one of the compromised files and run the command “stat” against it, like “stat filename”, to find the modify time. Take that modify time and compare the timestamp to the website’s access logs. You should find a “POST” request to another file which generated that malicious file. You may have to then take that file and do the same, until you are led back to the original compromise. If you’ve traced it back as far as you can and you are still not sure, take the IP address from the oldest access log entry that is clearly a malicious POST request, then run that IP through the logs. This method has always had a 100% success rate for me in identifying the root cause of a compromise. Once you identify the root cause, consider replacing any theme or plugin that may be responsible with fresh code. Make sure that the vulnerability is removed in the version you upload.

I hope that this helps!

Jarland