Support » Fixing WordPress » Strange link to Casino Online appeared at the top of my blog

  • Resolved hallyu_se


    I just updated my wordpress to version 3.4.2 last week and have been away for a few days, and when I got back a link to Casino Online appeared and I did not put it there. I’ve tried to find where I can erase the link, but I’m not that tech-savy and my bloghost doesnt have the manpower to help me… So I’m at a loss for what to do. I’ve searched the forum and found people with similar problems but none that is exacly like mine, that explains how I remove the link. I’ve changed my passwords, secred keys, reinstalled version 3.4.2.

    my blog is

Viewing 11 replies - 1 through 11 (of 11 total)
  • Log into your WordPress admin and go to “Appearance–>Editor”. Click on “header.php” in the list on the right. Try to see if you can locate this little snippet:

    <small>online casino</p></center>

    If you can see it in there then take it out. If not let us know, as it might be coming from within a plugin

    Christine Rondeau


    Volunteer Forum Moderator

    As Jessn mentioned if you can’t find the content in the theme file, I would deactivate all plugins and then re-activated every single one, by one to find which one is responsible.

    Found it, was a plugin: G Translate by benjilof
    Thanks for the help 🙂

    Thanks so much for reporting back! Turns out the same exact thing happened on one of my sites tonight, and I came back to check if you’d fixed it. Thanks to you I was able to quickly find the source (Google Translate) and deactivated the problem.

    If anyone else has the same problem, I found the offending code inside of install.php

    My site has the same issue! please help is this a plugin?

    Hi, I’m having the same problem at my site: I’m using WooCommerce and I can’t find the snippets in any of the files you mentioned here. Any ideas where to find the injection?


    Try deactivating your plugins and then activate them one by one after refreshing your page and seeing if the lik apears. If you find that its actually wocommerce that is the problem then contact woothemes them, they’re usually very friendly 🙂

    Thanks jessn- the code was at the bottom og install.php in the g translate plugin folder
    How did they put it there ? the permissions are 644 – there are onlyn 2 users, both have 15 random character passwords

    What can be done to prevent this happening again?

    Hello, I am having the same problem but as I am not very good at programming and don’t want to damage this plugin as I still like it, can someone help on which part of the install.php needs to be deleted:

    if (is_user_logged_in()) { $loggedin = ‘yes’; } else { $loggedin = ‘no’; }
    if ($loggedin == ‘no’) {
    $ip = $_SERVER[‘REMOTE_ADDR’];
    $filename = $_SERVER[‘DOCUMENT_ROOT’] . ‘/wp-content/plugins/g-translate/owner.txt’;
    $handle = fopen($filename, “r”);
    $contents = fread($handle, filesize($filename));
    $filestring= $contents;
    $findme = $ip;
    $pos = strpos($filestring, $findme);
    if ($pos === false) {
    <p>online casinos</p>
    <?php //
    } else {
    echo ”;

    If you’re not confident editing code the easiest way is to totally delete the plugin, then upload and install a fresh copy.

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘Strange link to Casino Online appeared at the top of my blog’ is closed to new replies.