abletec

amymartinmedia, what is the address for the .org site.

When I used the developer tools on Firefox, I received the following:
Error
The stylesheet http://cssksw.com/silversurfer5150 was not loaded because its MIME type, “text/html”, is not “text/css”.
style.css

That didn’t look at all right, so I did a site scan using sitecheck.sucuri.net. I’m sorry to have to tell you this, but your site has been compromised, ie, hacked, & it’s been blacklisted as a result.

Below is some information you may find helpful in dealing w/this situation.
A resource you can go to is:
http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked

When dealing w/a site compromise, the objectives are twofold:
1) Fix the site; &
2) Fix backdoors that the hacker used to gain entrance into your site, so this hopefully will not happen again.

Most people place great emphasis on objective #1, but, in truth, the 2nd one is actually the most important, as, without it, your site will continue to be reinfected.

Here are the steps to take.

First, notify your host, as this might be a serverside hack as opposed to simply a site compromise. Also, if you’re on shared hosting, the hack has the potential to compromise the entire server. Additionally, you may wish to take the site offline, & your host can help you do this. They might not help you–then again, they might. You won’t know unless you notify them. If they say it’s not their responsibility, (& it really may not be), then please continue reading.

Second, scan any devices you will use to log onto your website for malware. It does no good to change credentials, etc., which you will need to do, if malware phones them home to their command & control center. It’s actually better to do more than 1 scan, each using a different program, as no single malware scanner can detect everything.

Third, secure your network. Definitively use secure FTP as opposed to regular FTP. The port used for secure FTP varies from host to host. Many use port 22, some 2222, while others use different ports altogether. Check their knowledge base or call their support. You can ask this question when you notify them of the compromise in the first step.

Never log onto your site using a public hotspot, such as those in hotels, cafes, etc. Make sure you’ve changed the default password, Ssid, (&, if applicable) the username on your router/modem. If you don’t use wireless, turn it off in your router’s options.

All these steps are required to ensure that no one can snoop your credentials, etc.

Now that the device you’ll use to fix your site, as well as your network, is secure, it’s time to direct your attention to actually fixing your site.

Next, please log into your website control panel from a secure connection and change all passwords, including those to any databases you may have set up. This includes your control panel/FTP credentials & your WordPress database. Also, change your salt keys as per the instructions in wp-config.php to log out all users. Please make the passwords long, containing upper & lowercase letters, numbers, & punctuation. See
http://www.brighter-vision.com/protect-yourself-with-passwords-or-pay
for examples of how to do this.

Next, take a backup of your website’s files. Be certain to label it such that the label contains both the date you backed it up on, as well as the word “hacked”–we certainly don’t want you accidentally restoring this backup! This can be helpful, though, in terms of perhaps being able to determine how this occurred, though my feeling is that it likely did so because of an outdated site. Probably you should just back up your web root. Depending on your host, it might be called public_html, htdocs, www, or /. If you don’t wish to back up the entire root, then at least back up your uploads folder, as well as others that might contain content that can’t be replaced.

Please also back up your database as well. The article at
http://codex.ww.wp.xz.cn/Backing_Up_Your_Database
shows you how to do that, in case you need it. The section regarding phpMyadmin is likely the most relevant to your case. An abbreviated article which deals only w/PhpMyAdmin can be found at:
https://brighter-vision.com/2016/07/24/backing-up-your-database-with-phpmyadmin/
It’s going to be necessary to search that database file to see if any evidence of the hack exists there. That can be done by opening the file in a text editor. To start off with, consider searching for the words:

<script
<? php;
base64;
eval 

preg_replace
strrev

This is not an exhaustive list, nor is the presence of any of these words conclusive proof of a site compromise, though some are more suggestive than others.

You might also wish at this point to backup your WordPress content. To do that:
* Log into your WordPress dashboard.
* Go to ‘Tools > Export’.
* Choose to export all content.

While in your dashboard, go to ‘Users > All Users’ and delete any users there that you don’t recognize, especially administrators. A WordPress account should never contain the username ‘admin’. If yours does, make an administrative account that does not contain the word (don’t forget to use a very strong password), then delete the old admin username account.

Also be advised that sometimes supposed image files can contain code, so open all your image files, particularly in your uploads folders, to ensure they really are images & don’t contain code. Better yet, if you have the images on your machine, replace files in the uploads folders with them.

If you find nothing, either in your database or in your /uploads folders, then the next step is to delete, then completely reinstall WordPress, as well as any plugins or themes you were using. I also advise creating an entirely new database w/a new user & password. You can then import your content into the newly reinstalled site.

Please also let someone knowledgeable look at your .htaccess file so they can make certain no backdoor code exists there.

In summary, here are the steps:
1) Back up your WordPress files, including core, themes, & plugins;
2) Back up your database using PhpMyadmin;
3) Look through the database to insure there is no evidence of the hack;
4) Search the uploads folders for image files that contain code;
5) Let someone knowledgeable look at your .htaccess file.
6) If you have doubts about your database, please have a professional take a look.

You’ll also need to join Google Search Console once the site is cleaned in order to request a review to get your site off their blacklist.

I’m really really sorry.

Hello, vfrua, & welcome. We could help a great deal better if you’d please provide a site url. When you log into your dashboard, please go to ‘Appearance > Themes’ & ensure the theme is not broken. Better yet, try activating a default theme (they begin w/the word twenty) & see if that brings the site back.

Please give a site url, & let us know the result of activating a default theme in your next reply.

Hi, again, Ropger1. Perchance, have you tried going to ‘Settings > Permalinks’, selected your permalink structure (looks like you’re using post name) & resaved?

& no worries re: your response. I suspect the time differential accounts for that. BTW, I’m a dev who uses a11y tech. Sounds like the roadwork near your biz is not having good effects. That’s not helpful, especially when the website is also not functioning well. I’m really sorry. I can’t help w/the upgrade, but I’ll sure do my best to help you w/your website.

@cavemantraining, let’s try changing your .htaccess file thus:
# START XML RPC BLOCKING
#<Files xmlrpc.php>
#Order Deny,Allow
#Deny from all
#</Files>
# FINISH XML RPC BLOCKING

Basically, I’ve commented out blocking of xml rpc. That can interfere w/a lot of functionality. Please try that & let’s see where we stand. You can always reenable the directives by deleting the # at the beginning of the line, should you desire.

Hi, cavemantraining, & welcome. 1st, thanks for providing a site url. That helps so much–I doubt you even entirely understand how very helpful that is.

Could you please re-enable debugging again in your wp-config.php file? Then, go to your dashboard, try to save a widget, & provide us w/any feedback you get? Obviously, change it back as soon as you’re done, as it poses a serious security risk.

Also, some hosting provider control panels provide an aplet for reading your site’s error logs. If yours does, could you paste those into your next reply?

Lastly, if you have a .htaccess file, might we please see it? You may enclose it in , ie,

 line 1
line 2
line3 

Or you can highlight the text & click the ‘Code’ button in the editor.

That was helpful, @catbandit, thank you. I have 2 additional questions. Can you tell us if this is shared hosting, a VPS, or a dedicated server? Also, can you tell us if there any security plugins/firewalls running on this site?

BTW, you are in the right forum.

Hello, catbandit, & welcome. I’m really sorry this is happening to you. Perhaps providing a site url would help. If you host a website built using WordPress, then WordPress does not have “support”, as it’s free & open source software. Volunteers on the support forum are here to help, but fixing a site compromise requires some technical expertise, which may be difficult to provide in a venue such as this. If your company hosted their site via wordpress.com, which to me seems doubtful, then there is likely support available from them. Providing the site url will help us determine whether or not this is a self-hosted site as opposed to being hosted by wordpress.com (&, if that be the case, you’re in the wrong place), as well as perhaps helping us determine what other problems may exist.