BIG issue with my website, got hacked.

[James Spinosa]

Ok so I run a website that recently got hacked, and it redirects automatically to some spyware site. I have absolutely no idea how to fix this problem, anyone have a suggestion for me?

The site it redirects to isn't filled with viruses or anything, it is just makes a window pop up that says your computer is at risk and you should buy this product, etc. I'm looking at the index files, etc. and everything checks out.

Edit: I noticed this issue as a result of not making any money off it for the past week, so I checked the traffic and I was getting 1-2 visitors a day instead of 100+. I tinkered around on my server playing with things that I don't really understand and it seems to have stopped doing it. I would still love to know how people can gain access to my server like that.

Re-edit: It's doing it again

[Linda Buquet]

Yikes, I have no idea and have never had to deal with this problem, luckily!

However your host is the one to talk to. I don't think anyone can tell you how they got in without seeing your server set up. But it's your hosts job in part to offer protection and they usually have a security department that checks problems like this.

FYI they would also want to know about and check this out because the hackers could be using your site for behind the scenes stuff that could be putting a big extra load on their servers.

[James Spinosa]

Yeah the one problem with my webhost for that website is that they have notoriously horrible customer service. I actually figured out what the issue was after toiling with it for a bit. They hacked my FTP connection and used it replace my .htaccess file with their own, which had [rewrite cond] = (then they listed all the search engines so only search traffic would trigger it), and then had that redirect to that website.

I have no idea how htaccess works but the code was easy enough to figure out, now I need to figure out how to prevent this in the future.

Edit: Used a bit of my own hacking skills and got this guy's name, address, and phone number, I'll be reporting him to the authorities.

[Linda Buquet]

Good for you! Go get him!

[DaKnightFall]

If they hacked it once, they can do it agin. check all the scripts your running on your website with google to check and see if any are vulnerable to exploits.

[imwebdev]

Hi There!
I am glad you have found out the persons details who hacked into your system!
Make sure those details are infact for that person, and not an alias they use, as you may accidentally be getting someone else into trouble

In regards to your problem, there is no sure proof way to prevent someone from hacking your site (in my opinion). If someone wants to hack your site, and tries hard enough they will.
Even the US presidential candidates are not immune! They had their systems hacked during the elections.

You just have to be vigilant, and keep an eye out for any sudden changes to your website.

Some things you can do:
- Check with your webhost, as they may be able to put some extra safety measures on your website.
- Change your passwords frequently
- Do not use simply passwords. Use upper and lower case as well as symbols (if your host allows), and make the password long.
- Are you using a website script or a content manager? I.e. Are you using something like Word Press or something similar? If you are ensure you have the latest version with security updates. Security holes in scripts are the easiest ways for people to get into your site.

Hope that helps!
Cheers

[tan]

And how can we recognixa who had hacked the site?

[yollyp]

That is the question only the "super experts" can answer. Remember, these hackers are great too, so we should face them with the greatest "warrior" too. And who is this so? Hmmmm, our own selves. We should be very vigilant and police our own.

[FrankPetser]

Hmm, does your site have a message board or some other place where people can post stuff like a shoutbox for example? If you allow html and javascript to be posted there someone can easily post all sorts of scripts there.

[jumar112]

I also got hacked into my site last October but did not find it until last month.

I have a blog attached to the site and believe that one of the plug-ins that I downloaded for the blog added a folder to my blog sub-domain that had HUNDREDS of .html files with articles and words that would make a sailor blush.

I never did find out where is actually came from. But went into my manager log file and started writing down all the IP address that where going straight to that folder. Then I changed my .htaccess to ban all the IP's I wrote down.

It has taken over two weeks to get it all straight but i am seeing that once the IP that is banned tries to view the file over and over and is not allowed stops coming in.

James: I am glad that you found out who it was and hope that criminal charges would be filed.
Did you change your password to get into your hosting account. If not, make sure you do that ASAP and use letters, numbers and characters (like @$%) in the password. Also when you log into your hosting account is there anywhere that shows you Last Logged In: and a IP address?
My account has that so I always look to make sure that the IP address is mine. One time I logged in and it showed something different, so i backtracked it, then took a picture of it and sent a 911 message to my hosting company to find out how long this person was in. Was glad to hear it was customer service from my hoster that was helping with another situation.