Over the years, we have seen plenty of WordPress hacks and thankfully they are usually fairly easy to diagnose. This bank holiday Monday we have fought a nasty one from cashnude.com a spammy website which opens up an adult chat as a pop up, under your site.
1. The first thing you want to do is change your FTP (File Transfer Protocol) password, this is just an extra precaution encase your password has been comprised. Regardless it’s always good practise to change your password on a regular basis, and may even help avoid more serious exploits from affecting you in the future.
2. Next you want to disable SSH (Secure Shell) access to your server; this stops your server from sending or receiving encrypted data from WordPress to avoid any sensitive data like passwords being compromised or the code injection from spreading further.
3. Finally, you want to log in to your PHPMYADMIN and run the following query:
update wp_posts set post_content = replace(post_content, ‘‘, ”) where post_content like ‘%%’;
Additionally, you’ll want to run the second query below.
update wp_posts set post_content = replace(post_content, ‘', '') where post_content like '%%';
These two queries will remove the code that seems to be causing the exploit that is present on every page. The code was recording what the user clicked on, on each page and when they clicked it was opening up an adult chat under your site. By removing the code the pop up is no longer present and the code injection can be purged.
We can also use Majestic Neighbourhood Checker to check the sort of other sites hosted on the same IP to get an idea of any other sites that may potentially contain viruses to be aware of.
Viruses, worms and trojan horses are all things to be vary of when using the internet as they are ever present online. In order to further protect yourself further from the threat these pieces of malware pose you should be wary using sites that you haven’t heard of or that look a bit dodgy and ensure you change your password on a regular basis, especially straight after any piece of malicious software has been dealt with. When you believe something might be infecting your website or your computer investigating it further and seeking help online are the best options for ensuring it doesn’t cause too much damage.
