The link could be generated in javascript or somewhere in the PHP files. It could be embedded in your theme files or somewhere in the WP source code. The problem is you could find a bit of code somewhere that’s creating it, but still be missing other potential bad files.
First place I would look would be in your theme’s front-page.php file to see if you can find anything unusual there. The front-page.php of your theme generates the static front page / landing page.
After that, whether you find it or not, I suggest to carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures. There’s a possibility that your site could be hacked. Spam links like that generally don’t appear randomly, so it’s best to do a security check of your site and make sure that you’re not playing host to some malware.
Thread Starter
lu5t
(@lu5t)
The theme that I’m using doesn’t seem to have a front-page.php
I’m using a custom ‘blank’ template to handle my landing page
<?php
/**
Template Name: Blank Template
*/
?>
<html>
<head>
<link rel="stylesheet" href="<?php bloginfo('stylesheet_url'); ?>" type="text/css" media="screen" />
<style type="text/css">
body { background-color: #cccccc; background-repeat: repeat-y; background-position: top center; background-attachment: scroll; }
</style>
<title><?php wp_title( '|', true, 'right' ); bloginfo('name'); ?></title>
<?php wp_head(); ?>
</head>
<body>
<?php while (have_posts()) : the_post(); ?>
<div id="container" class="blank-template">
<div id="content" role="main">
<div id="page-content">
<?php the_content(); endwhile; ?>
</div>
</div>
</div>
</body>
</html>
I got Sucuri Scanner and I’m trying to use that to scan for recent changes + malware. Is that sufficient?
I would go a little deeper than that. I ran a Sucuri Site Check: http://sitecheck.sucuri.net/results/www.kidsteethdoctor.com and it didn’t bring back anything. In fact, it doesn’t notice the link at all, despite it being there.
List of Links Found
http://www.kidsteethdoctor.com/homepage
Disabling javascript also doesn’t get rid of it, so that more likely means that it’s something in your source code.
In addition to WPyogi has posted, I would add to try running a scan with a plugin like Wordfence to double check.
If you don’t have a backup to return to, you could end up getting nowhere by running a few simple scans and not securing the site more. The code could be embedded in various parts of the installation, and not removing it cleanly could just end up making it return over and over again.
Thread Starter
lu5t
(@lu5t)
Thank you both! I’ll look into these options.
Thread Starter
lu5t
(@lu5t)
I wordfence to find any backdoor php functions and this fixed my problem.
