Support » Fixing WordPress » All URL's except Homepage keep going 404…..

  • Hello,
    My site was hacked about a month ago and someone helped re-install and solve that issue on the server side, but shortly after we began to have this issue where the all of the pages on the site when you clicked through went 404. It wasn’t the personal 404 I set up with a plug-in, but the godaddy server 404.
    First I solved the problem by activating/deactivating the plug-ins, this worked but only temporarily.
    Then I saw that just “reseting” the permalinks fixes it, but again it fails.
    Today I deleted all of my plug-ins from the site, but again, the issue still came back and everything 404 but the homepage.
    I have heard it could be an htaccess issue, i messed with that and have had no luck, but I have noticed that this:

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
    RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
    RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
    </IfModule>

    Keeps getting written into the .htaccess. Any ideas if this is my trouble and what could be causing this?

    Havingsaidthat.net is my site, I will let the fail stick and not refresh anything if you think seeing the 404 page will help.

    Thanks for any and all help,

Viewing 15 replies - 1 through 15 (of 18 total)
  • Moderator James Huff

    (@macmanx)

    If that keeps getting mysteriously added to your .htaccess file, I’d suggest that the hack probably still exists.

    Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    So I followed the list, worked with GoDaddy, installed Wordfence (which found and removed something), but this code:

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
    RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
    RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
    </IfModule>

    Keeps getting put in my .htaccess. This has to be the issue, anybody have any history with this?

    Moderator James Huff

    (@macmanx)

    Hm, try deactivating all of your plugins (all of them, even Wordfence), then remove the code from .htaccess

    Does it re-appear, even with all plugins disabled? If not, one of your plugins is adding it, so just reactivate each one individually until you find the cause.

    indy7solo, I see from your website that you must have been able to fix the issue. Could you share how as I am experiencing exactly the same. Thanks!

    Actually, I have not figured it out yet apparently.

    I installed wordfence and another security thing, and everything looked golden there for a couple days, but the issue has reared its ugly head again.

    Very frustrating. You have any luck finding solutions?

    Moderator James Huff

    (@macmanx)

    How about the reply I left 4 days ago? Any luck with that?

    indy7solo, – Ah, after one day of a happily working website mine is also again back to 404 pages. Annoying!

    MacManX (James Huff) – I will try your recommended solution now. Thanks for the tip!

    I also noticed that I have 4 weird files in my WordPress core directory, namely:

    -gdd-webform.php
    -gddform.php
    -h-s.txt
    -s-g.txt
    -starting.php

    The h-s.txt had this in it:

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
    RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
    RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
    </IfModule>

    I deleted now all of them and keep my fingers crossed!

    It was helpful, and got me to the best place the site had gotten too lately, but alas.

    This:
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
    RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
    RewriteRule ^([^/]*)/$ /starting.php?p=$1 [L]
    </IfModule>
    Getting written into the htaccess file over and over again, replacing the standard wp one, has to be the issue right? I can’t find what is changing it though.

    Moderator James Huff

    (@macmanx)

    Have either of you asked your hosting providers to take a look? It will help if you come to them with the date and time you last set the .htaccess file to what it should be, and the date and time you last noticed it had changed again.

    MacManX (James Huff) – Thanks – Not yet. Site is still ok, so still monitoring!

    indy7solo – I also just came across this thread: http://wordpress.org/support/topic/htaccess-file-overwritten-new-form-of-malware?replies=12#post-5910015. Might hopefully be helpful to follow!

    My Malware scanner keeps finding these issues once the glitch comes back.

    /home/content/87/5833387/html/.htaccess
    /home/content/87/5833387/html/cache.php
    /home/content/87/5833387/html/gd-webform.php

    Ringing any bells?

    Also, Caramaple, do you know how to add .htaccess to the definition updates? How often does that refresh?

    Thanks guys,

    Moderator James Huff

    (@macmanx)

    Have you asked your hosting provider to take a look? It will help if you come to them with the date and time you last set the .htaccess file to what it should be, and the date and time you last noticed it had changed again.

    i will try that, when i last called they made it sound like you couldn’t fix the issue. That was a lot of help, huh?
    I hope to get back in touch with them, just have a ton going on right now, ugh….

    Moderator James Huff

    (@macmanx)

    Yeah, a hacked site on their network should concern them a lot more than that. I hope they’re more helpful this time.

    Dont know how to add .htaccess to the definition updates, sorry.

    I now also came across this thread: http://wordpress.org/support/topic/404-error-page-permalinks-fix-not-working?replies=12. Just sending it through as maybe someone finds a solution. Interesting that we are all on GoDaddy though.

    Difficult to know what the solution is as we always have to wait a couple of days to see whether the site survives. I hope we find a fix soon!

Viewing 15 replies - 1 through 15 (of 18 total)
  • The topic ‘All URL's except Homepage keep going 404…..’ is closed to new replies.