What to do if you've been hacked.....

[RobertChapman]

Just logged into our CMS system and it appears we have been hacked.

All page titles have been hijacked adding a secondary title tag linking out to website http://emapaydayloans.com with anchor text pay day loans.

Our Web Dev team are working on fixing the hack now. My concern is the potential knock on effect to SEO.

This looks like a bad neighbourhood site:

• 3 pages indexed
• PR 0

And for I don't know how long we've had almost every page on all our domains linking out with the following page title including the same link and anchor text:

payday loans

I assume its a wait and see at this stage.

[Jinx14678]

Fix it as quick as possible

Find any exploits you may have missed (keep WP Up to date, disable admin account, if on shared hosting check all file permissions, make sure you are using SFTP (port 22) ect...)

Monitor your traffic for drops and check web cache of Google to see if it was even indexed

If you do take a knock (which I doubt unless it was there for a while) I am not sure a reconsideration would do anything, so you will probably just have to do some damage control

(ie... get lots of social mentions on a good piece of industry relevant content)

Hope this helps

PS this can help you with hardening WP install http://codex.wordpress.org/Hardening_WordPress

[irvingw]

if you have a paid hosting company call them and they'll run tools on your site to find any exploits.

if your traffic is holding steady you might be ok, just get those links off your site and take care of the security holes. Also your FTP write/edit permissions might need to be tightened up.

[EGOL]

This type of problem is really hard to fix unless you know how to do the deep scrubbing needed to get rid of the problem.  If you don't scrub it properly the problem will recur over and over.

I would hire a pro ASAP.

[RobertChapman]

Thanks for the responses guys, looks like an SQL Injection.

We have cleared the import and all is back to normal. We'll be looking in to beefing up protection. Thanks for the advice. Will be keeping my eye on the traffic via analytics and watching out for messages in Webmaster Tools