UnHacking your WordPress Weblog – Google results for your blog appear strange?

Seeing spam indexed in the content of your google results of your WordPress WebLog? I am and thus am currently debugging it. My notes are here. Seeing spam in the results that looks like this:

Using Google Search Terms: WordPress hack googleI found an article that relates directly to this symtom.After a quick look using an FTP tool at my theme directory I found the only things modified recently were: header.php and footer.php ……..the dates were today and yesterday. Thus its an automated thing most likely. Thus before taking any steps to remove the spam links in my theme files I need to shut down the alteration process. 0. I used my text editor to remove the links from header.php and footer.php …..I then completely locked down my these files using mod rewrite so no one including me can use the WordPress scripts to modify them. Next I did the following: ( cut and paste from the security arty linked above ) 1. Secure the /wp-admin/ directory You probably know that most of your WordPress sensitive information is stored in the /wp-admin/ folder. Right out of the box, WordPress leaves that folder open, so people can access these files if they know what they are doing. Matt suggests to place a .htaccess file inside the /wp-admin/ folder to block the access to all IP addresses, except yours. Here is the code you need to put in the .htaccess file: AuthUserFile /dev/null AuthGroupFile /dev/null AuthName "Example Access Control" AuthType Basicorder deny,allow deny from all allow from xx.xx.xx.xx allow from xx.xx.xxx.xx 2. Hide your plugins Many WordPress plugins come with bugs and vulnerabilities that can be exploited to damage your website. The last thing you want, therefore, is other people being able to know what plugins you are using. If you visit the folder /wp-content/plugins/ on most blogs, however, you will be able to see all the plugins that are being used. In order to hide that list you just need to create an empty index.html file and drop it there. I should really update my plugins also. I want to use the automatic update plugin because Dreamhost updates force you to reinstall all your plugins and yikes that does not sound like fun! The detailed upgrade procedure is here.