Tiffany Washko

Sometimes the mood just strikes me and I decide to start a new blog or web site. This time I was reflecting on how much time I spend with Google Alerts looking up all the juiciest info I can get about the Twilight books and movies. I am a BIG fan. Soooo… I decided that I should be making some money while I have my fun and I have started a Twilight blog.

I am super happy with the way it turned out especially because I knew I wanted a magazine style WordPress layout and all the best ones were premium themes you have to pay for. I was just about to drop $150 on a developers license for one such theme when my stubbornness kicked in and I decided to look one last time for a freebie. Woot! The theme I ended up using is called Visionary. I love it and it was easy to customize and the layout is perfect. I was afraid to pay for a theme and then have it be so complicated I would spend a week figuring it out…I hate themes like that.

I think I had this blog up and ready from domain purchase to completely finished with 4 posts, 6 pages, 1 Amazon astore, and 2 galleries in about 3 hours.

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

I have had a rough month being a WAHM this month. If you recall my blog was hacked and my search engine traffic was being redirected to a spammer site. I thought that was the end of it….but the saga continues. I have several blogs and of course they targeted my main blog (not this one)…my bread and butter blog so to speak. After I got rid of the anyresults.net hack I thought I was in the clear but I wasn’t.

A few days later a fellow blogger emailed me to let me know that his own blog had been hacked and spam was being injected into his blog invisibly. You could even look at the source code and not see a darn thing. He found the links by analyzing his blog with CURL and the links all went to my site…aka buy your viagra here and then a link to my blog…only there were 30+ plus links for all sorts of spammy products and drugs. Of course he went to my blog to see if I was the spammer who hacked his blog and of course found nothing..until he looked at my blog with CURL and saw I was hacked too. He was nice enough to email me and let me know.

I hoped he was wrong but since I didn’t know how to use CURL I couldn’t verify. Then I did two things to test. I went to Google’s Webmaster Tools and looked at the keywords they had indexed for my site and sprinkled throughout were the spammy keywords. Then I searched for “viagra and my URL” and TONS of links had been indexed. I was dangerously close to getting banned by Google for being a spammer and in fact I have met several people during this fiasco that didn’t catch this hack until they did get banned.

Also, via a tip to use CRON from a Mom Masterminds member (LOVE that group) I ran a CURL string:

curl –user-agent Googlebot + URL

This verified in a way easy for me to see, where the links where. I was still shocked when I saw them for the first time though. They all pointed back to my own site. The overall goal of this hack is get you banned from search engines…perhaps so the spammers can rank better for the SERPS you currently hold. They are knocking out the competition. Oh and they added new Adsense info at the bottom of the page, maybe even siphoning my Adsense commissions.

So…..the blogger who emailed me also gave me a link that helped resolve the hack. There is a lot of info there but only some of it applied to my situation. For instance some of these hacks involve code directly implanted into your theme files but my situation was a little different. My hack was disguised as a plugin and not one that you could see in the wordpress dashboard. Sprinkled all throughout my files I found what looked like image files or regular php files:

filenames “*_new.php” , “*_old.php”,. “*.jpgg”, “*_giff”

They were all coded hack files and there was over a dozen of them…back doors to keep open so the spammers could keep accessing my site. They would make a plugin run under the radar that would inject the spam links. I had to check wp_options in my database and see what was listed under active plugins…I found the culprit there, deleted the code and deleted what I thought was all the files. I also deleted all my users and there were a few suspicious ones there and I scrubbed the database. Case closed.

Or so I thought. A couple days ago I checked Webmaster tools again just for the heck of it and guess what…the hack was back. So I just cleaned it up AGAIN…and did an even more thorough search. I only found one file that I think I missed the first time but one is all it takes. Now I have CRON being run to check for spam injection links every hour on the hour and the results are emailed to me. It is a pain but I am not going to let this go unchecked again. Just today I think Google cleared out the last of the badly indexed files although some phantom keywords still show in Webmaster tools…I hope they go away soon.

Soemtimes it is not so fun to be a blogger and Internet Marketer…especially when you are being sabotaged.