Support » Fixing WordPress » Have I been hacked?

  • My site was not loading earlier, as I received a parse error referencing the general-template file located inside wp-includes. After replacing the file with a local copy, the issue was resolved.

    I opened the general template file that had the problem and compared it to my local version. The bad file had this code inserted in it which prevented the site from loading:

    <?php
    //LINKBLOCK
    //LINKBLOCK
    ?>

    Does this mean my site was hacked? If so, would simply replacing this file fix the issue from happening again? I was running the latest version of WP, changed my pws, and looked through my files via FTP and didn’t notice anything else that was strange.

Viewing 8 replies - 1 through 8 (of 8 total)
  • Any help is appreciated.

    Hmmm, doesn’t sound like a hack to me. What plugins are you using? Is LinkBlock one that you’ve used previously?

    No, just Akismet, Google XML Sitemaps, and Subscribe To Comments.

    That PHP line of code, which appears to have been maliciously added, blocked my site from loading.

    I’m not saying that it definitely isn’t a hack, it’s just that code wouldn’t actually do anything. It’s just a PHP comment. A hack would normally insert malicious code, to either add spam links, a defacement or to try and either redirect the visitor to another site or install malware on their pooter.

    Can you look through your server logs around the time to the file was altered to see if you can spot anything else suspicious or out of the ordinary?

    a link to your site and we could maybe verify

    whooami

    (@whooami)

    Member

    theres NO forgivable reason, why any file living inside wp-includes/ should be edited, or magically turn up to have been edited by a plugin

    http://matthewpaul.com

    I know it’s just a comment that was added, but the ?> is what closed the rest of the PHP in the file and preventing the site from loading.

    Anyone?

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Have I been hacked?’ is closed to new replies.