Saving Hacked Woocommerce Stores

Google labeling your site as hacked is nightmarish. You will lose almost 95% traffic and 100% SEO.

What is a hacked site.

When google bot detects malicious script or spam links inserted within your website; it identifies it as “hacked” . Further Google takes a manual review and if reviewer confirms the malicious script inserted within your website, it labels it as “Hacked” In search results Google will explicitly warn visitors that its a “hacked site”.

Hacking of a site may happen on any e-store including Magento , Opencart , Prestashop we find it a recurring problem in Woocommerce-Wordpress based sites.

So how a woocommerce-WP site gets hacked?

A hacker pushes in the malicious code and spam links by exploiting a loophole in poorly coded plugins and themes installed. Many a times user installs nulled plugins or free available themes by downloading them from untrusted sites. These already have malicious trojan horse kind of code hidden in. Once the hacker confirms that your site is infected he uses the same malicious code to move it or hide it at multiple locations within a target site, making it difficult to detect.

Typical code injection and hideaways locations.

1. Themes : /wp-content/themes/downloaded_themes ( injection code is hidden inside the theme ,plugins etc)
2. Plugins : /wp-content/plugins/
3. Upload directory : /wp-content/uploads/
4. wp-config file in root directory
5. Includes folder : /wp-includes/

So what needs to be done If my site is infected?

We get at least 2 requests a week to recorrect such websites and here is our approach.

Manual Auditing

1. Nothing can replace better clean up than line by line code manual auditing . We download the entire site and go through it file by file to identify the malicious code locations. These are removed manually
2. Its also necessary to find the source of these infections (may be theme or plugin) . once the source is identified either it is removed /updated or replaced. Identifing source requires considerable development experience.

Automated Tools.

1. Then automated code scanning tools are used to scan the site. Good quality antivirus plugins are available on Wordpress extensions. which may be installed and put of periodic scanning mode.
2. Lastly a third party tool like Sucuri is used to check site online for any infections.

Request to Google

1. Finally a request is made through google webmaster tools for Google to reconsider the site and remove its “hacked “ label. Typically Google reviewer will revert in about 1 week after auditing your site.

What can be done to Prevent woocommerce WP stores from getting hacked

1. Always keep updating the plugins and WP installation.
2. Install themes and plug-ins only from trusted sources and after checking its reviews.
3. Remove the default user “admin”.
4. Install well rated anti-virus plugins which are available free on WP-Extensions.
5. Use a good strength password and keep backing up your website.

More Info Contact: [email protected]