You need update all WP and Plugins.
[sig moderated as per the Forum Rules]
@babyskill: Please stop posting links to your site. These are community support forums – not free advertising boards.
Thread Starter
isnet
(@isnet)
Hello,
We reinstalled the site on a new server including wordfence and a firewall. Had the below message this morning. How do I correct this? How can I make the site show correct umlauts again?
Thank you
“
An option was found in your site that indicates it may have been hacked.
Severity: Critical
Status New
The ‘blog_charset’ option in your database is set to ‘UTF-7’ which indicates your site may have been hacked. If hackers can gain access to your database via phpMyAdmin for example, they will change this value in order to inject malicious code into other parts of your site or allow XSS attacks. The ‘badi’ hack does this. ”
Thread Starter
isnet
(@isnet)
Hello,
Found the problem:
All our sites suddenly had the option under Settings >>> Reading to set the character. I think this option is normally not there. This was set to UTF-7 but this must be UTF-8. Change it to UTF-8 and save. (you will see that after saving the option of changing the UTF character has disappeared) Go into your widgets area and you will see that your widgets have been removed from the side bar except for one text widget which is placed there by the hackers:
<script>document.documentElement.innerHTML = unescape(‘%48%61%63%6b%65%64%20%62%79%20%59%7a%2d%62%79%74%65’);</script>
Remove this widget, clean your PC, and start setting up your site again. Install wordfence and wp firewall. We have to redo hundreds of pages with German language.
Thanks Isnet!
I have been strugling with this problem for month!
Now the site is working well again.
Thanks!
Gerlof
