Site URL Redirect Hack causing site to load another URL

hello I have a site that has been hacked. when you go to the site URL it sends you to another site. it also does this when you go to login to the wp admin area. Any ideas of how to fix it? it is litefavorites.com

thanks

  • Adam Czajczyk

    Hello Cody,

    I hope you're well today and thank you for your question!

    I'd start with following steps:

    1. Access your server via FTP and then
    2. Download the ".htaccess" file of your site and compare it against the one (for single or multisite install, depending on whichever you're using) on this page:

    https://codex.wordpress.org/htaccess

    If there are any changes, make sure you adjusted the file to match given default examples.

    3. Download the WordPress install package of the same version that you're currently using and

    - extract it to your local storage
    - upload all the files and folder except: "wp-config.php" file, ".htaccess" file (if there's any) and "/wp-content" folder to your server, overwriting existing ones

    3. Assuming that you didn't make any changes to theme files, try re-downloading theme installation package and

    - extract it to your local storage
    - upload it to your "/wp-content/themes" folder

    4. Download this script and install it on your server (as described on that page)
    https://interconnectit.com/products/search-and-replace-for-wordpress-databases/

    then use it to search (use "Dry run" option first) your site's database for an URL that you're being redirected to; this script can also be used to replace all occurrences of that URL with a proper one.

    This are essential steps and hopefully will help though I can't say that for sure yet. Please give it a try and let me know of the result. Please also, for security reasons, download your entire current install and export full db (using phpMyAdmin) to keep additional backup of a current site.

    Best regards,
    Adam

  • Cody

    hey Adam

    so i found the A records on my domain name were totally wrong. It looks like they have been hacked.

    neither of them was my server IP address. I didnt add either of them.

    I have pointed it to my server now and I am waiting on the DNS to update.

    i loaded the site on a staging server and it works perfectly. no issues. So I think the trouble was the domain A records. Does this make sense?

    thanks!

  • Adam Czajczyk

    Hey Cody!

    I admit I didn't though of this. Yes, it makes sense though is quite surprising and I'd suggest getting in touch with the provider that maintains DNS for your for this domain as soon as possible and letting them know about the case. If I was walking in your shoes I would push them very hard to examine their server logs and triple-check everything for security.

    As you're know waiting for DNS update, let's see what happens then. Let me know if this indeed solved the issue, please!

    Best regards,
    Adam

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.