If you are unlucky, you might have noticed something odd about your Web sites using WordPress. While it doesn’t effect how your site looks in the browser, it does effect how Googlebot sees your site… and thus how it determines your search engine rankings and the contents of your Google cache. Essentially, it makes Google think your site is filled with content about online pharmacies and viagra. This hack replaces the content that Google sees entirely. It affects written content, titles, links, meta tags . . . you name it.
This didn’t happen to my personal site, but it did happen on one site I’m managing. We simply couldn’t figure out what was happening. There was nothing new on the server whatsoever and our .htaccess was untouched. Somehow these spammers got into the database and made relatively minor changes. Obviously changing your passwords is a first good step no matter what the cause.
WPBlogger had a post about the problem and recently also introduced a fix from Christopher S. Penn. I had previously removed any obvious references to viagra and other drugs from the database using phpmyadmin, but that doesn’t take care of all of it. Instead you also have to submit a query to find specific rows in your database and then drop them. The instructions are fairly simple:
“Log into your MySQL database (most hosts have this via PHPmyAdmin) and execute this query:SELECT *FROM `wp_options` where option_name like ‘rss%’ ORDER BY `wp_options`.`option_name` ASC
What you’re looking for is an entry that starts with rss_ and then some random numbers. The text of the entry is encoded javascript, which looks like this:
FFPJ1JpnyfUnpDzz3h9tfaI92uDvyD/Of+r4XyJ2f2Uev6U539WDM39kP10QFLP53+Y5BaX3+0/a03rZ0
0nKX5Na27hXdOSw17TGuO7pDWt/+Na0+lVHHdrWrScqzVqdysqybmiWvILqqXzn5L+ehyvSzriIZHsf
oIiUKwlJvcjvH69FR7SHB4UNXyXOaZw+ivT8dhjkZ6rtGj+PPJRMlCW5ePEZVlLOj8YkgL80/26Luefq
VXgStMY/Afw/
Delete this entry.”
Obviously you have to be familiar with phpmyadmin to do anything about this, but the fix is simple and quick. Once I found the row with the rss_ content I dropped it. I then headed over to http://web-sniffer.net, which lets you view pages through Googlebot’s eyes. The problem was gone entirely.
So give this a shot if you’ve had a similar problem. Hopefully the WordPress developers will figure this out soon.
