The Great Hack Of 2011
So a bunch of us WordPress addicts and some other GoDaddy customers got hacked a couple of days ago and some are still having issues. This hack affected this blog as well as some of the blogs of our Social Fabric community members.
This post details what we did to fix the issue on the CB blog. If you’re having similar problems with your site, hopefully these steps can help you as well. Unfortunately it’s not a super simple fix and also not a one-size-fits-all fix either.
Here is what we did:
- I cleaned up the .htaccess file, this can be found using an FTP client or using your hosting company’s file explorer (it should be located in the root directory of your site)
- I patched what was probably the cause (I say probably because there isn’t a real good way to say it’s definitely the cause)
- I asked Google for a review (This can take a while and is the most frustrating)
This third step is perhaps the most important. Once you clear up the source of a site hack, Google may still have your site flagged as containing malware. Until you ask for a formal review, Google and other search engines may continue to flag your site for inappropriate content.
I hope this helps you out, catch me on Twitter @cwhittl if you have any questions and I will do my best to help!
Also here is an explanation of the issue and some general tips for WordPress security (it can be a little technical so don’t worry it just background for those that might care)
http://blog.sucuri.net/2011/08/timthumb-php-security-vulnerability-just-the-tip-of-the-iceberg.html
admin
cbAdmin
jaythornton
lizlongcrier
Monica
John Andrews
Brad
Courtney Velasquez
Mailena
Jerra Nalley
Ted Rubin
Mel Lockcuff
Sandy Jenney
KateBerg
Alex
Casey
StewartCox
Kathleen
laurenrodkin
Rebecca E. Parsons
tylerbradley
heidiclark
Marc Shalom
jonb
zachjones
Joan Cook
Annette McCormick
cbblog
Isra Hashmi
Brian Carreno
Melissa Garcia
kimj
Chris
Amy Callahan
darielacruz
Lori Pace
brandijeter
Deshaun Artis
kristenbrown
Christy
marytarczynski
kristinwheeler
melissagarcia
aardvark.antiques.ga@gmail.com
yosu.cadilla@gmail.com
cbguest
priscillayagoudaef@hotmail.com
ashantialas@hotmail.com
katherinyovino@hotmail.com
darlenadunkentell@hotmail.com
eunadowdell@hotmail.com
This happened to me, twice in 2010. WordPress + GoDaddy = invitation for hackers. I moved away from GoDaddy. Not a problem since.
Yeah we are definitely working towards that..
What were the signs and symptoms of your hack?
Hi Trudy sorry about the lag in me replying… We we’re moving this week and just got back to a place with WIFI…
The symptoms are 2 part.
1) If you search for your site via google (actually go to the google site and search for your site) when you click the link it takes you somewhere other than your site.
2) If this happens for long enough google will detect it and flag your site as malicious.
Thanks Whittle and Jay for fixing this so quickly! You all were ON it!
High five.