Quite a few weeks ago I noticed a few things amiss on my blog. Then one day my mom said that the site was down entirely. I contacted my host and they indicated that my .htaccess file was the problem so they renamed it. The site came back up. But some of the problems I had noticed before didn’t go away.
Before you go on you might be here because you think your site is compromised. Check here.
My web traffic had declined tremendously.
My RSS feed title had been changed to something spammy.
Search results for my site gave the site title as spam.
For instance, instead of “Ryan McFarland’s blog » Print your own (Monopoly) money” the page title would show as “Windows Email Server — Discount -137% price off” or something like that in the search results. My page was still at the top of the search results but nobody would follow that link.
Here is an example from someone else’s blog.
That is the first result for a search for “Day-Lab Ice Blue Necklace $28” (Link goes to their page.)
The first thing I did was check my blog template files. But nothing there seemed out of the ordinary. But a look at my source code on the resulting pages was messy with spam words. What the heck?
I scoured the net looking for a solution. It looks like since I still used the “admin” account for my login for the site that I was the victim of a brute force attack that got my password. Perhaps it was a compromise of my ftp password. My web host announced a security failure and reset everyone’s ftp passwords.
I tried everything listed on this source for how to fix a different hack of WordPress blogs. But none of them seemed to be the source of my problems.
Finally I found it. A file called style.php in my theme was packed with nasty spam links. The clever name was easily overlooked when I was scanning through template files looking for the culprit. There should be a style.css file. I deleted all of the text in the php file from the WordPress template editor and the problems cleared up. My results in search engines cleaned up quickly.
What I find interesting is that other blogs are still linking to me according to the incoming links list on the WordPress dashboard:
I’ll try and contact those site owners to have them try and clean up their sites too.








