Hackers who add such links don’t do it in plain text they either use base64_decode() or strrev() along with eval().
First change all your passwords and switch your theme to Twenty Thirteen or Fourteen. See if the link disappears. If it does search for any of these functions in the elegentWhite files.
If you can’t find any such code in the theme files deactivate all plugins. If you still get these links go to dashboard > Updates and click the “Re-install Now” button. This will overwrite existing core files so that any files that were modified by the hacker are undone.
I suspect this to be the work of a plugin which is hooking into the the_title filter to show links under every post title.
Looking in the HTML code I also find two more links and some CSS to hide this with absolute positioning.
Jesin, Thanks a million! That found the hack, in one of the plug ins which is now deleted.
I really appreciate you help!
Great to hear that!!
Make sure you install plugins only from trusted sources. If it is a premium plugin you should pay for it and get it only from the official site.
There are many sites which give away premium plugins for free at the cost of embedded hidden links or even worse backdoors.
Can you share the name of the plugin so that others would also stay away from it.
Also mark this topic as resolved.
Topic resolved.
I’ll check the plug in name and revert with it.
