During November / December, my site (www.maxmynorm.com) was doing very well with monetization from AdSense, ContentAd and Advertise.com, but I had a security scare just before Christmas. I was advised to update to the latest versions of Newspaper and WordPress (which I did), and since then, regular profit-making articles have all run at losses every single time I run traffic to them (driven by Yahoo Gemini).
I am well aware that the time of year would have had an impact, but I am concerned that my site has been compromised in some way – not only due to the sudden change in revenue performance immediately after the updates, but also it now seems to take much longer for the pages to load.
I have tested running traffic to numerous different posts on my site, and every one of them – including new ones – has performed badly.
Sadly I am not a techie by any means, but is there any way of testing the site to check its integrity, or to validate that the updates installed have been correctly dealt with?
Well, it’s good to keep up on security issues, as WordPress continues to refine its core platform and will advise to update when security vulnerabilities are found (e.g., “cross site scripting” issues, or a problem with ajax/java, or comments injection, etc.). This is the nature of the Web. Technically “SSL” has not been “secure” the past 20 years, contrary to the term secure. SSL3,TLS1,TLS1.1 are all not secure. So, the web continues to evolve and mature in terms of learning to actually test for security problems.
Right now, both Newspaper and WordPress are as secure as “is known” if you have the latest versions of each.
You should also check for articles online for how to harden/secure a WordPress site (e.g., don’t let folks register, don’t have your admin username be “admin,” us a plugin like limit login attempts to block folks trying to guess passwords, turn off editing of files from the WP admin panel, make sure your web host uses a dynamic system like CSF to auto-block IPs probing your site, avoid OLD plugins written prior to 2015, etc.).
You can use tools like Securi to scan your site for known malware, and your host can do the same.
Note that Google massively changed their algorithms in January to deal with issues of content spam based on “brand names” and other things, so every site with lots of “brand names” and company names may have seen some major changes in SERPS.
Checking your Google Webmaster Tools/Search Console regularly and examining what’s going on there is also advisable.
Hope that helps 🙂
Thanks for this Chris – much appreciated.
I uploaded Securi and ran a scan which reported I was clear of any harmful stuff (malware, malicious javascript etc) so I’m not really any further forwards.
My hosting company made the same suggestion (although they suggested Wordfence…) so I’m still in discussions with them about other possible causes.
I still can’t get around the fact that the dramatic change in the site’s performance was at the exact same time as the WordPress and Newspaper theme updates.
Following my reply above; I’ve just logged into my site from my mobile, and it’s being diverted to unauthorised sites.
This is exactly the same problem I had just before Christmas which prompted the software updates, so something is clearly still wrong and I am feeling very nervous!
You may have a DNS redirect hack; not theme related.
Make sure you *DISABLLE* any other mobile plugins like Jetpack mobile, or anything like WP-Touch.
In fact, REMOVE any plugins you don’t actually use! Remove old themes you tried but no longer use.
Check your htaccess file for malicious redirect code; resave your permalinks in WordPress.
Make sure you have full back up of your site also.
Also try doing things like running a page speed check at gtmetrix.com to see if anything funky being loaded on pages you don’t recognize; check the page source of a post on your site where you have a redirection.
Check your Google Webmaster tool tab for “malware detected” — as Google will check this too!
Pre-emptively, you may wish to to a clean install of WP, by over-writing all the WP files in root (make back up of your wp-config.php out of paranoia); delete and replace the wp-includes, deleted and replace wp-admin folders.
MAKE SURE you have a legal download copy of theme from ThemeForest and not something you “found on the web” also! (Ahem, which of course you didn’t do, but one person I’ve seen DID and that was very much a DUH moment for him!).
Hi again Chris.
I spoke with my hosting company, and they said they’d found infected files in my Tracking Code Manager plugin, WP Booster, and the Newspaper theme itself.
I was told to delete then reinstall these files; I’ve deleted the TCM plugin which was easy enough, but I’m struggling with the WPB one (I thought that was some coding within the theme itself?)
I’m also not sure about how to reinstall the main theme (which I did buy legitimately! From ThemeForest).
Can you help out?
Hi, you can just upload the theme files via FTP which is the best way to do that.
There is no infection in the TagDiv booster and Newspaper theme. So, installing clean version of that is best way.
The simple way to do it is this:
deactivate all plugins, then via FTP, delete the booster plugin in wp-content/plugins/
delete the newspaper theme folder in wp-content/themes
upload fresh copy via FTP of the Newspaper folder to wp-content/themes
As far as infection — I had suggested also doing clean install of WORDPRESS, which is always a good idea if you know you were hacked.
You can often hire somebody to do all this for you if you don’t know how.
I might be getting somewhere at last… but not all the way!
I ran a Wordfence scan and it highlighted wp-includes/js/plupload/instal1.php as a potentially dangerous file. Another forum agreed that it was harmful, but I’m trying to find out whether I can safely hit the ‘delete file’ option Wordfence gives, or if that might cause other problems.
My non-technical brain is wondering if the file is a malicious one in its own right, or if it might have been a genuine one from the original set up and may include legitimate stuff my site still needs.
Well .. again (sigh) .. .a clean install of WordPress would solve that.
if you DELETE the wp-includes folder and install a new copy then that solves that, right?
Simply go to WordPress.org and DOWNLOAD the zip file for WordPress … follow the upgrade instructions on WordPress.org to upgrade via FTP.
If you learn to use FTP, you can see all your files and directories, and you can easily delete both the wp-includes and wp-admin folders, and upload fresh ones from the zip file for WordPress. And then over-write the other “root” files from the install zip (it won’t over write the wp-config.php file as there isn’t one in the installer).
So, unless you actually do what I suggested which is a clean install of WordPress, not much else I can say on this topic.
