Database hacked - what do I look for (2 posts)

  1. cellobella
    Posted 8 years ago #

    The database of my website - http://redsultana.com - has been hacked I think. (View source and check the list of nasties at the end)

    I've since put a clean install of 2.3.1, changed the password of both my database, and WordPress. As the links still appeared I assume there is something in the database.

    I've looked and searched but I'm really not sure what to search for. Would there be a string I could type in the search function?

    Any clues would be welcome.

  2. cellobella
    Posted 8 years ago #

    Okay... could I be getting closer...

    First of all I deleted my galleries page and discovered that the number of links drastically reduced in number.

    Then, I've found in the rewrite_rules in wp_options of the database the entry below.

    When I delete it - next time I open the file - it's back.

    Which suggests I think that somewhere else there is maybe a bit of nasty code...

    Any thoughts?

Topic Closed

This topic has been closed to new replies.

About this Topic