Hello interwebsites,
I think a rule as general as that could cause problems with basic functionality in WordPress and many plugins and themes. If I were you I would start by going through the apache access logs and check if any legit traffic on your website follows that pattern. I’m suspecting there will be some legit traffic like that and therefore there is no easy solution.
If I were you I would probably import all those URLs to a separate table in my database and then write a little plugin or code snippet for my functions.php file that checks the $_SERVER REQUEST_URI for a match against that database and throws a 404.
Thanks for the quick response. Damn!
Hmm that looks a little beyond my skill level, I’m hoping google will figure it out soon. Or there will be some htaccess or similar solution. All the links start with a ? and as far as I am aware I cant find any other areas of the website that use http://www.thecassettes.com.au/?other-randome-text-here
This doesn’t work 🙁 I guess the ? is a special character in URLs
RedirectMatch 301 ^/?.*$ http://www.thecassettes.com.au/
Hello interwebsites,
you should be able to check your access logs. If you don’t want to access them manually there should be some statistics tool on your webhost that you can use to start looking at your traffic.
Yes lot’s of spammy traffic but they just end up at my normal site. I just want to remove those URLs from google. Hopefully there is a simple soloution to redirect all those URLs to a 404 page and google should quickly remove them.
I have the same exact problem, but I did find some strange code in my .htacess which I removed. After removing that code the url’s went back to the Home page… (instead of showing the spamy porn content)
Interwebsites were you able to solve it?
My customer’s site did the exact same thing:
I also have:
urls indexed with spamy porn style urls, and All the urls start with a question mark which seems to stop wordpress redirecting to a 404 page instead all those links just display my home page.
I also need to clean this up with Google.
I scanned it with WordFence and WF didn’t find these URL’s …is that odd?? It picked up some other minor issues but not these BIG ones; why wouldn’t it find these ??
Thank you ahead of time 😉 ANY help would be appreciated!
Hello fourwhitesocks,
to answer why Wordfence didn’t detect it I would need to know more about what was in your .htaccess.
This code was inserted just before the normal # BEGIN WordPress and that is what I removed; I didn’t recognize it. After removing it then at least the URL’s that started with ? went to the Home page and didn’t show porn any more…
This code below was inserted just before the normal # BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule !(js|ico|gif|jpg|png|css|swf|flv|libraries|maint|admin|login|logout|reg) index.php [QSA,L]
</IfModule>
THANK YOU!!
Ok that code is not malicious so Wordfence would not have objected to it. All that does is redirect requests not matching js, ico, gif etc to the frontpage. Were you seeing porn displayed under your own domain name, or were visitors forwarded to a pornsite from your site?
No, you saw the porn when someone did an organic search for something that we may have a blog post about and if you clicked on that link in the search results then yes it took you to porn.
I got a list from Google SEarch Console of the URL’s that were affected but when you navigated to the actual page from Google’s list, there was nothing wrong with the page, unless it was somehow cloaked; which obviously it was or how would it even have shown up as spam in the Google Search Console?
After removing that code above when you clicked on one of those crazy URLS’s that Google informed me of OR clicked on one of those links in a search then the URL (even though it might have had questionable content with-in the actual URL) it started redirecting to the Home page.
I never added that code in our .htaccess file tho, so where did it come from??
Hello again fourwhitesocks,
I don’t know where it came from. Maybe another plugin? Something to do with redirection or SEO? The code does not cause a redirect to porn though.
If links containing your domain name were redirecting to porn it means you have some malicious code on your website. What did the URLs in google console look like? (You can give example but replace domain name with domain.com or something like that).
I kinda wondered that, that code seemed so benign, must have been a coincidence that right after I removed it the porn page didn’t show any more. Unless could it have stopped showing like after I updated that Plugin, or is that a coincidence too?
You are absolutely correct that we had some malicious code, it’s all been removed now thankfully. I ended up finding some of it in a Jetpack rss subscription form widget; but I don’t know if that means that’s where they came into the site from…..
Here is an example of a URL that was redirecting to a porn site:
myDomain.com/?Sexual-Predators-2010-Jelsoft-Enterprises-Ltd
So is it odd that WordFence didn’t find something like this after scanning? That is my main concern…??
It sounds like the stuff in .htacces may have been leftovers from when you had malicious code on your server then. It was not malicious in itself but it could possibly have helped the exploiters redirect more efficiently, depending on how the exploit worked.
Did you scan while you still had the malicious code on your server and Wordfence did not intercept it at that time?
Finally found a solution.
This serves a 410 error you any links that start with a question mark.
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} .
RewriteRule ^(.*)$ http://www.yoursite.com.au/$1? [G,NC]
So far the public site appears to be working fine, Although I guess search and some other features could be interfered with. I don’t use this and I figure if I run this for a week or so google should drop all those links from their index.
Only problem this removes all styling from the admin. Once I figure out the solution to that I will post it. But it has instantly reduced my traffic. I had 50 to 100 people on my site real time in GA, where previously I had 10 or so visitors a day.
Oh wow interwebsites, thank you for the update, cleaning everything is such a PITA lol!
I ended up having to have SiteLock go in and scrub the rest of the site because I was worried that I might have missed something even tho the action I took before the ‘scrubbing’ seemed to have resolved at least people seeing the bad stuff 😉
I have a question for you though: when you were still having the issue, were people getting a message that your site was hacked or a warning or something – like either on the page itself or somewhere in the search results? There was no warning or message shown to people when it was happening to our site even thought in Google Search Console they said that visitors would be shown a warning that the site was hacked…????
Trying to learn for the future aggggg
