Malware on your WordPress site?

Recently, a panicked client called us stating that instead of their website coming up, a “Warning: visiting this site may harm your computer” page was appearing. In addition, Googling their company brought up a “this site may harm your computer” link next to their search result entry. Whoa! Not good.

After some research it had been determined that their FTP credentials had been compromised, and that a hacker in Russia had placed malware on their site for distribution. Sucks, but it happens and it needs to be fixed right away.

The first step is to close the door on the bad guys by changing all passwords for the site. FTP, control panel, CMS admin, etc.

Next, you have clean up the Malware. All of the site’s files need to be reviewed for anything out of the ordinary. Access the site via FTP or your webhost control panel’s file manager – with your NEW password of course – to review the “last modified” date and concentrate on anything changed recently or even after your last publish. In our case, there were a handful of HTML and PHP files that had embedded javascript pointing back to a .RU domain, and a couple of strangely-named new files that didn’t belong – all dated very recently. It was easy to strip the scripts back out and delete the bad files files.

Next, login to your Google Webmaster Tools account and verify ownership of the site. (What – you don’t have a Google Webmaster Tools account? Well, get one – it’s free and provides you with detailed reports about your pages’ visibility on Google). There’s a couple of different ways to verify, but the easiest is to install the Webmaster Tools Verification plugin for WordPress and use the META tag method of verification. Other verification methods may fail for a WordPress site since WP takes any pages, code or tags you give it and wraps content from the theme you’ve selected around it.

Once verified, you can request a malware review under the diagnostics link. That’s just so Google can verify that the site is now clean. Within a couple of hours, you should be back in business.

(No Ratings Yet)

 Loading ...