Are Your Wordpress Sites Infected?

Well the last week has been a real eye opener for me. Having one of my main sites hacked has given me a lot to think about.  I know now that I have to move away from WordPress which is going to cause a great deal of work. For now though, as I said in my previous post, I’m working flat out to make my WordPress sites far more secure.

I do though strongly believe that many affiliates are running hacked sites which will result in a penalty from Google as per the statement below

Hidden links whether put there by the website owner or by a hacker or a violation of Google’s Webmaster Guidelines and can result in a site being penalized or even de-indexed.   (Google’s process of indexing is automated and there is not really a way for them to determine if the hidden links were added by the website owner or a hacker.)

Remember my site was functioning normally with no visible sign of any problem until one day most of the key phrases from the site received a -450 penalty. I checked all the pages in multi browsers viewing the source code and could see nothing wrong. It was not until I use the Google Labs Tool, Fetch As Google Bot that I could see the source of the problem which was hundreds of inserted spam links.

For anybody who experiences a drop in rankings for a WordPress site I would advise that your first port of call should be to check your site’s pages with the Fetch As Google Bot tool. This is the only way you will see the spam links.

Next check all your site’s source code. Search for source code for something that starts like the  example below.

ob_start();eval(base64_decode(‘aWYgKCFmdW5jdGlvbl9leGlzdHMoImNoaW5zdCIpKSB7IGZ1bmN0aW9…………….

Better still search for “eval(base64” in your files.

To convert the above string go to # and copy the string then select decode base 64. This will convert the string into readable code. If you are using a free theme then you will probably find the above sort of string in your themes footer and maybe even the function file. You can though of course check the contents of the string by decoding it.