• Resolved melodys2412

    (@melodys2412)


    Sometime in the last few days, our pro version of the Pretty Link plugin started redirecting all of our links through ushort.com, rather than our website, so all our links are broken. For example, one redirect now displays as https://urshort.com/zsqsyYtTy0r8/coachkit rather than https://ekithub.com/zsqsyYtTy0r8/coachkit ….if I paste the ekithub url into the search bar, it redirects as it should. However, if someone clicks the link we put into an email, it goes through the ushort.com redirect and ends up in a blank white page.

    Our hosting company says there’s been no breach/hack that they’ve found. We’re waiting for the results from an independent security scan to ensure there’s been no hack.

    • This topic was modified 1 week, 6 days ago by melodys2412.
    • This topic was modified 1 week, 6 days ago by melodys2412.

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support oiler

    (@eulerarthur)

    Hey there,

    Thanks for reaching out!

    What you’re seeing doesn’t match how PrettyLinks normally behaves: redirects are meant to run on your own domain, so if clicks are ending up on ushort.com instead of your site, something outside the plugin is likely rewriting or intercepting the URL. That can sometimes be a compromised site, but it can also come from email link tracking, a security filter, or something else in the path between the click and your server.

    The detail that pasting the URL into the address bar works while a click from email does not is especially useful, because it suggests the problem might not be only on the WordPress side. To narrow it down, could you send one specific Pretty Link that does this, plus where you’re clicking it from? It would help to know whether it only happens from email or also when the same link is clicked from a normal webpage.

    In the meantime, running a deeper scan with something like Wordfence or Sucuri is still a reasonable step, and it’s worth checking common places where unwanted redirects get injected, such as .htaccess, wp-config.php, and the database, for anything that references that third-party domain. Once we have a concrete example and a bit more context on how the link is being opened, we can point you in a clearer direction.

    Looking forward to your reply. Thanks!

    All the best,

    Thread Starter melodys2412

    (@melodys2412)

    It actually changed within the plugin itself. See here: https://www.dropbox.com/scl/fi/o9ci077is71syl5r75er9/prettylink.png?rlkey=34uk6qip68vsb3zljk6kv968n&st=vwf2yeg7&dl=0

    I may have found the hack using a deep scan with Wordfence. It looks like a rank-math xml was uploaded which has the ushort code in it.

    Thank you!

    Plugin Support oiler

    (@eulerarthur)

    Hi there,

    Glad to hear you sorted this out! I am closing here then, but please feel free to contact us anytime if you need assistance with our product.

    Kind regards,

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.