perezbox

Hi @posword and @tara

What is being described isn’t something that SiteCheck would detect. SiteCheck works to identify security issues that display on a users browser. Think things like malware distribution, malicious redirects, SEO spam.. etc..

So just because it’s green, doesn’t mean that your environment hasn’t been hacked. It could be being leveraged for some other nefarious act.

Unfortunately, changing the passwords on FTP / WP-ADMIN are only the first of many steps that need to be taken. In fact, here is a list we’ve put together that we share with our own customers, but would be just as valuable for you: https://sucuri.net/website-security/what-to-do-after-a-website-hack.php

Here is also a document we put together a few years ago, but still applicable today of things you could do specifically with your local WordPress install: https://blog.sucuri.net/2012/11/website-malware-removal-ftp-tips-tricks.html

Lastly, don’t forget to spend some time looking at this page on the codex: http://codex.wordpress.org/Hardening_WordPress it’ll help you think through the various hardening steps you should consider.

Yes, this can all be a bit overwhelming, but such is the world with Security. The biggest thing you need to be asking yourself is how they are getting in, how are new users being added. If it’s in fact related to something an admin is doing, then great. But if it’s something no one on your team is doing, then that’s a problem. And the thing you need to be most aware of is the addition of things like backdoors and the sort that allow bad actors to circumvent any existing controls placed on your access nodes.

Hope this helps.

Thanks

Hi

Have you tried contacting whomever you tasked to help clean your website? What you describe is a bit weird, but it’s hard to know without knowing all the details.

As you have things phrased right now it’s a bit hard to really provide any response of much value.

Thanks

Hi @lcartier1

Not a problem, you’ll want to log into your database and update the administrator account. Your host should be able to help you with this. The hack itself own’t matter at the moment, at least not until you log in again.. 🙂

Tony

Hi

If you’re sure you’re not redirecting or infected, you could try using the Google URL Removal tool here:

https://www.google.com/webmasters/tools/removals

And submitted the site to be reindexed.

Have you tried that?

Thanks

Great, thanks. Very curious case.

Thanks

Hi @sarumbear

In the same link we provided, we share a link where we explain in more detail how the “remote” aspects of our scanner work.

For your reference here it is: https://blog.sucuri.net/2012/10/ask-sucuri-how-does-sitecheck-work.html

I’m sincerely sorry you feel wronged in some way, but as my colleague mentioned, it’s open-source and if you feel you have a better way then by all means. We’re very particular here at Sucuri in the way we market and the way we describe our services, even the free ones. It’s why we’re very specific to say this is a remote scanner, and go on to explain how a remote scanner works.

Thanks for insights.

Tony

Hi @saludcasera

Sorry for the experience, I’m sure it was not intentional and there’s likely a lot more to the discussion. The issue however I hope is now addressed, right?

Thanks

Hey there

Umm, let’s see if we can’t look into this and figure out what is going on.. mind sending us an email to labs@sucuri.net? Would like to see if maybe we need to update the profile..

Thanks