Security Check

  • wblair

    (@wblair)


    6 years, 7 months ago

    Yesterday I started getting messages that say “Unexpected response: Security check”. I didn’t think anything of it until I realized that every page I had gone to wouldn’t modify. So after some exploration I found out that I can’t modify the site’s content, or even update/uninstall plugins. Since then I have logged out and back in, Disabled all of my plugins (They just come back after I leave the screen), and Changed the theme twice (also just changes back). I have checked the file permissions and everything is still correct. I have cleared all of the caches and deactivated and deleted them all but they also return. I have attempted this on chrome, safari, and firefox.I have cleared all of my cookies, reset my permissions, cleared the cache and still nothing.

    It is ridiculously frustrating. The only thing I can think of is using ftp or ssh and delete everything in the the plugins folder and themes folder…

    Does Anyone Have a fix or heard of something similar?

    • This topic was modified 6 years, 7 months ago by wblair.
    • This topic was modified 6 years, 7 months ago by wblair.

    The page I need help with: [log in to see the link]

Viewing 9 replies - 1 through 9 (of 9 total)
  • Thread Starter wblair

    (@wblair)

    6 years, 7 months ago

    I cannot modify anything through my cpanel or file manager either.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    6 years, 7 months ago

    I’m pretty sure you’ve been hacked.

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter wblair

    (@wblair)

    6 years, 7 months ago

    Thanks for the quick response Steve. I had that same thought too but it showed and still shows no malware or any other signs that I have been hacked. I just double checked it.

    No Malware Found
    No malware detected by scan (Low Risk)
    No injected SPAM detected (Low Risk)
    No defacements detected (Low Risk)
    Google Safe Browsing
    Norton Safe Web
    PhishTank
    Opera browser
    SiteAdvisor
    Sucuri Malware Labs blacklist
    SpamHaus DBL
    Yandex (via Sophos)
    ESET
    ADMINUSLabs

    Clean
    AegisLab WebGuard

    Clean
    AlienVault

    Clean
    Antiy-AVL

    Clean
    Avira (no cloud)

    Clean
    BADWARE.INFO

    Clean
    Baidu-International

    Clean
    BitDefender

    Clean
    Blueliv

    Clean
    CLEAN MX

    Clean
    Comodo Site Inspector

    Clean
    CRDF

    Clean
    CyberCrime

    Clean
    CyRadar

    Clean
    desenmascara.me

    Clean
    DNS8

    Clean
    Dr.Web

    Clean
    Emsisoft

    Clean
    EonScope

    Clean
    ESET

    Clean
    ESTsecurity-Threat Inside

    Clean
    Fortinet

    Clean
    FraudScore

    Clean
    FraudSense

    Clean
    G-Data

    Clean
    Google Safebrowsing

    Clean
    K7AntiVirus

    Clean
    Malc0de Database

    Clean
    Malekal

    Clean
    Malware Domain Blocklist

    Clean
    Malwarebytes hpHosts

    Clean
    Malwared

    Clean
    MalwareDomainList

    Clean
    MalwarePatrol

    Clean
    malwares.com URL checker

    Clean
    Netcraft

    Clean
    Nucleon

    Clean
    OpenPhish

    Clean
    Opera

    Clean
    Phishtank

    Clean
    Quttera

    Clean
    Rising

    Clean
    SCUMWARE.org

    Clean
    SecureBrain

    Clean
    securolytics

    Clean
    Spam404

    Clean
    Spamhaus

    Clean
    Sucuri SiteCheck

    Clean
    Tencent

    Clean
    ThreatHive

    Clean
    Trustwave

    Clean
    URLhaus

    Clean
    URLQuery

    Clean
    Virusdie External Site Scan

    Clean
    VX Vault

    Clean
    Web Security Guard

    Clean
    Yandex Safebrowsing

    Clean
    ZCloudsec

    Clean
    ZDB Zeus

    Clean
    ZeroCERT

    Clean
    Zerofox

    Clean
    ZeusTracker

    Clean
    zvelo

    Clean
    Checkmark
    Checking for cloaking
    Looks cool.

    Checkmark
    Status codes
    These should normally all be the same.

    Google Chrome returned code 0
    GoogleBot returned code 0
    Checkmark
    Spammy looking links
    Any links with funky anchor text? Nothing scary here!

    Checkmark
    iframes
    Any iframes? Nope!

    Checkmark
    Blacklist Checks
    Google Safe Browse reports not in malware database
    Phishtank reports URL not found
    Domain clean by Google Safe Browsing
    Domain clean by Norton Safe Web
    Domain clean by McAfee
    Domain clean by Sucuri Labs
    Domain clean by ESET
    Domain clean by PhishTank
    Domain clean by Yandex
    Domain clean by Opera
    Domain clean by Spamhaus
    Website Malware & Security
    No malware detected by scan (Low Risk)
    No injected spam detected (Low Risk)
    No defacements detected (Low Risk)
    No internal server errors detected (Low Risk)
    Site is up to date (Low Risk): using WordPress 5.2.3

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    6 years, 7 months ago

    Trust me, you’ve been hacked. Things are not right with your site. I don’t want to put any details here publicly.

    Thread Starter wblair

    (@wblair)

    6 years, 7 months ago

    Crap, I’ll keep checking it and send it in if needed. My email is [redacted]If you don’t mind filling me in. Any knowledge helps. I understand if time is lacking though. I appreciate it.

    Thread Starter wblair

    (@wblair)

    6 years, 7 months ago

    Thanks for doing that for me. I had set a timer to remove it.

    Thread Starter wblair

    (@wblair)

    6 years, 7 months ago

    Thank you Steve, you we’re most definitely right. I appreciate it. Big time.

    • This reply was modified 6 years, 7 months ago by wblair.
    michaelnagel

    (@michaelnagel)

    6 years, 5 months ago

    I am receiving the same message as wblair on my site, portland-hypnotherapy.com. Unlike wblair though, I could update plugins. Could you share with me the same fix that worked for wblair? Thank you Steve.

    Thread Starter wblair

    (@wblair)

    6 years, 5 months ago

    If you can update your website most it’s probably been hacked or has malware on it. I would run a scan on it. If you don’t have one you can download a free plugin that will check your website at

    https://ww.wp.xz.cn/plugins/sucuri-scanner/

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Security Check’ is closed to new replies.