Site is too slow? Seeing a new code.

[Beachflower]

Site is too slow. I am seeing this new code more than 1000 times in my home page-

What should I do now?

My site- http://a1stlucie.com/

[brettmandoes]

Just to verify - this is js that your company/client did not insert themselves?

[Beachflower]

I don't think so. But why over 1000 times?

[brettmandoes]

Well it could be a few things. Either it's always been there and you never noticed it before, your company/client added it but did so in a way that populated it out over 1000 times as an error, or the site was hacked and the js was inserted by a malicious entity. It looks like they're using a link shortener in the src part of that js, which makes me nervous.

[Beachflower]

Yes I think. They are using that to slow the site down. and its working.

[brettmandoes]

Hi Beachflower,

Did you ever get a resolution to this? I'm curious to see what the outcome and solution was. If this is a malicious attack then you'll need to consult someone who specializes in net sec, but I've dealt with a few different kinds of attacks before so I can make a couple of recommendations.

1. Change all of your logins. Make them unique and difficult for a bot to guess. Then set it to lock out users after five incorrect guesses. This prevents brute force hacks.

2. Add a honeypot to your login forms. A honeypot is a hidden field that bots will try to fill out on a form. Users can't see it, so they don't fill it out. If it gets filled out, the program knows it's a bot, and invalidates the attempt to login.

3. Use screaming frog to find all the js that was maliciously inserted on each URL and create a "cleanup" list. A developer should be able to write a simple "find and replace" program that just deletes it.

4. Consider migrating to https if you haven't already. This can prevent Man-in-the-Middle attacks (MIM) on your site, and also confers several SEO benefits such as improved user experience, a slight boost in ranking, and faster site speed (HTTP/2 integration).

These are just a few first steps to take and a Net Sec professional will have much more to add. Hope that helps!