Website security tips – What to do if website is hacked or malware infected

How to detect malware ? Find out if your site is hacked.

First off, if you want to find out if Google found suspicious code on your site, use the following URL, appending your domain name to the end part.

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://www.dailyseoblog.com

Surprisingly many of the times, when a site is hacked, (I don’t mean the ones like Twitter gets once a while, where you get a totally different homepage) webmasters don’t realize that the site is hacked. This is because only a part of the site is hacked, and you know it only when you see a dip in traffic / indexed number of pages.

So the important factor is to identify a hack, as soon as possible, so that you can do all that you can do minimize the ill-effects that may occur.

1. Sudden drop in number of indexed pages

When I say drop, I mean a huge one like in thousands. Indexed number of pages are heavily fluctuated and if you take it seriously can cause unnecessary worries. But if you see that either a huge part of your site is not showing up in the google live index, OR your main pages don’t show up on the live SERPs (with a direct key phrase match) , then you might want to consider worrying.

2. Heavy dip in traffic

Mostly accompanied by a hack is dip in search engine traffic as Google would’ve already found the hacked pages and took the site out of index. You don’t want to let this happen to your site.

3. Google Webmaster Tools shows weird pages

Google Webmaster Tools are pretty quick in detecting malware on sites. And it has a lab feature where all the suspected malware code will be shown.

4. Site shows up for “black listed search queries”

When you search for phrases like “viagra” (unless you;re using them in some context) with your site: command search, your site shows up pages. That’s the last thing you want to see.

What should a webmaster do if he finds his site malware infected.

Step 1 – Check for security configuration on your servers. Check for Directory permission and Apache security. Find more details here.

Step 2 – Remove all outgoing links from the user generated areas of your site. Because, this area is often exploited by hackers. It wont in most probabilities clear the site of malware, but it will stop future risk.

Step 3 – Remove all Ad scripts running on the site. Many a times invisible iframes are used via advertisement codes used on your site without your knowledge, the best option is to keep away from such ad codes (especially from less reputed vendors) but if you end up in a situation, remove them.

Step 4 – Switch from Telnet and FTP to SFTP.
Telnet and FTP are both considered insecure because of their use of plain text protocols. They transmit usernames and passwords in a way that anyone with access to the network can read.

Step 5 – Take the site offline temporarily.

If you can’t get things back to normal, take it temporarily offline, so that Google don’t index more hacked pages and end up in more confusion. Then best way out is to issue s 503 status.

Step 6 – Let Google know that something has screwed up

You can let Google know that one or more URLs in your site has been compromised and you want to take it/them down. Use the URL removal tool from Google Webmasters Tool.

Step 7 – Fix what is wrong

If you can manually fix all the malware, well and good. Generally malware affects only parts of your site, like a footer.php or header.php. In such cases you can manually edit out the bad areas and roll back to fresh code. And once you’re completely sure that things are under control, request a malware review for the site.

Step – 8 Request a malware review from Google

1. Go to Webmaster Tools Home page, select your site.
2. In the Parts of this site may be distributing malware message, click More details.
3. Click Request a review.

If your site is completely screwed and Google has taken you down from the live index, you should think about clearing your site of possible malware by manually checking all the codes and once everything is safe, request a re-inclusion request.

How to prevent future malware problems ?

- Stay away from using WordPress/CMS themes, templates that have not been verified. Some themes (which are even available on popular sites) contain hidden code, that you won’t even realize.

- Do not entertain non-reputed vendors to publish ads on your site. Especially with Javascript code.

Some Additional CMS Security Tips

WordPress – Tips to increase security in WordPress

Joomla – Security Checklist for Joomla

Drupal – Security Tips

Php Nuke – Security Tips

Possibly related SEO & Social Media Articles

• SEO Tips Day 14 – How to submit a new website to search engines ?
  Submitting to search engines, technically means applying for an inclusion to the search index of a search engine. Some SEOs treat this as a service, offering different methods for new websites to get listed on the search engines, but in my opinion this is a very basic necessity every webmaster must go through. Submitting websites to [...]...
• 5 Must do daily SEO tasks to keep your site out of errors and in good health
  Little piece of advice to all those who’re serious about SEO health of your site. I suggest all my clients to regularly keep a watch of their SEO metrics and stats, just to be sure because most of the things (errors) when creeping in does not show itself immediately. its only possible to detect a [...]...
• Google Site Index and Sitemap – Working together
  Many a times, there have been questions posted up at the WebMasters forums, asking the solution for the discrepancy in the number of pages indexed from your website shown on the Google site index and the Webmasters console. site:www.yoursite.com gives the number of pages indexed by Google on its regular index while the webmasters console shows [...]...
• Search Engine Optimization tips for MSN Live
  Search Engine Optimization techniques are pretty much similar for all search engines like Yahoo and MSN. If you optimize your site focusing Google, then others follow – that’s what we’ve seen so far. However, the MSN Live team too have some specific SEO techniques they suggest to webmasters that help in search engine specific metrics. [...]...
• Remove other sites from the Google search results
  Google has a new option for webmasters – that enables us to remove a particular information on a website from it’s search results. Vanessa Fox today released the Webpage removal tool that will enable users to delete off indexed pages from your site on Google’s index and also information/pages on other sites. The latter [...]...