I got a disturbing text a few days ago. Seems that when a business associate looked up my business name in Google, they saw a message, just below the main site URL, that said “This site may be hacked”.
You can see an example of this message here.
Grammar aside (Google is not giving permission to hack the site, they are letting me know that the site might already be hacked), this is a pretty disheartening message to see, especially on a site you worked so hard to bring to life.
In a nutshell, the message is telling you that Google scanned your site and has detected the possibility of malware. In their words:
You’ll see the message “This site may be hacked” when we believe a hacker might have changed some of the existing pages on the site or added new spam pages. If you visit the site, you could be redirected to spam or malware.
In my case, I had an old install of WordPress on the site, one that I no longer used and one that was not exposed via any publicly linked pages. Somehow, the varmints got in and added some extra PHP files to the site. The code was cryptic, using arrays of bytes that clearly held a stream of code to be executed by another chunk of code.
No matter, I wiped the server clean, changed my passwords, reinstalled the site from backup. By the time I got all this done and tested, it was late and I was done for the day. All that remained was to figure out how to connect to Google to get the site rescanned.
Woke the next morning, ready to dive into the Google bureaucracy, and what do you know, the message was gone. My theory is that Google maintains a list of hack-tagged sites, rescans on a regular basis.
I have to say, I appreciate the help Google. You really had my back there. Thanks.
It didn’t even take a trip to Mountain View to get it fixed. 😉
I’m impressed. Great service.
I’ve seen this happen a number of times, and every time it’s a WordPress site. Of course that’s just my personal experience. It’s easy to fix, and if Google doesn’t automatically update you can request a rescan, it doesn’t take long.
As a developer we’ve looked at using WordPress, and have used it on projects, but we’ve come to the conclusion that WP is essentially a bag of snakes that isn’t worth the effort needed to implement it properly. WordPress can be done well of course, but in our case by the time we’ve done that we might as well implement a custom build using our own CMS. Not to mention the ongoing maintenance required to make sure the WP site is secure. Long term I wouldn’t use WordPress for anything. But again, that’s just one Gorilla’s opinion. Glad you got it fixed.
You do have good point, Gorilla. My site used to have WordPress for online portfolio and no blog so I decided to scrap it and use just non-WordPress if I only update my site once a year for new online portfolio. http://aaron.im
Again, sometimes WordPress can be useful for some reasons, like this site.
An old, un-tended install of anything big and popular will probably fall foul of robotic attacks in the end.
The latest WordPress can at least be set to self-update, plus if you subscribe to something like Automattic’s VaultPress they’ll scan and patch for big vulnerabilities regularly, even hitting “popular” vulnerabilities in third-party plugins.
Anyway, this is a good reminder to go delete anything on a public web server that you’re not actually using…
Crazy as it sounds, I recommend not auto-updating; that feature requires files to be writable on the server, even if only by Apache/PHP, but it’s the number one place I’ve seen WordPress hacked: code (especially obfuscated code as Dave suggests) gets injected into existing files. Way less convenient, but more robust, in my Canadian opinion, is to set all WordPress files to ‘read-only’ by all users: owner, group, and world. This will break the update mechanism, but it’s safer to do that, update on a local copy of a site, and only unlock the files to push an update. 99% of the time they’re read only and uninjectable.
Well, a) it was an old, unmaintained install. Doing that is kind of asking to be hacked on anything, esp WordPress which gets a lot of bot activity since it’s so widely used.
The issue with bespoke CMSes is that a) you’re unlikely to be better than everyone else at security and have to monitor and update your CMS, b) you lock in your client which is good for you, not necessarily for them. As an alternative, take a look at Craft which seems clean, modern and very well done (no connection, I develop sites on WP and am playing with Craft as an alternative).
That’s fine if you manually update. What’s not OK is to disable auto-update and then never check the site again.
However, your method of disabling them is… not good. http://codex.wordpress.org/Configuring_Automatic_Background_Updates shows how to configure these. Obviously, moving everything to read-only has other advantages and disadvantages, but if all someone wants to do is configure the updates, do it the right way.
Yes, I do that too, although I don’t entirely trust it… Anything set by PHP can be un/reset by PHP. It’s all a trade off of security vs convenience, for sure, but one or two hacks becomes very inconvenient indeed…
We built our own after years of working with others that weren’t good enough. Our CMS is pretty high level, all standards-based, any competent programmer (meaning Comp Sci degree or Masters) could take it over. Now, somebody with a few years of informal dev experience, yeah, they probably can’t step in. But any real programmer could.
Our custom tools also allow us to build anything that can be imagined (and is technically possible), and we can deliver custom admins as well. It’s really slick. I’ve used lots of other systems, dating back to 1995. We finally built our own because a) others weren’t good enough, and b) I actually invented some CMS related stuff that’s pretty neat (more common now, but when we started doing it I wasn’t aware of any other system with similar capability).
So for us there’s more upside than downside doing bespoke work, and as long as we stick to standards there’s no lock in.
You make another good point about WordPress, it is widely used which makes it a huge target. Plus I find the admin side too complicated for clients. We’ve worked hard with our CMS admin, it requires almost no training.
And you probably do 5 and 6 figure contracts I’d bet. That’s a way different world as people aren’t going to want to leave you as readily and you’re not going to decide this web development thing isn’t for you all of a sudden.
Yes, we’re in that range, but what we can do compared to what a typical agency charges, I’d say we’re affordable. But yeah, for a higher level of project. Systems like WordPress are just too much headache, too much risk. But WP does have the advantage of being cheap, it’s ‘bootstrappable’.
I dunno, I’ve used Squarespace here and there for really small but interesting projects, it’s pretty good when you use it right. If someone has less than 10K to spend on a website, I’d say find someone who knows how to use a turnkey framework like Squarespace, or Shopify, maybe The Grid (if that pans out). Some of those are actually good. But cripes, don’t DIY, that’s such a lie, even with something that seems as easy as Squarespace. The important part isn’t being able to do a thing, it’s knowing what to do and why.
Yeah, my point wasn’t that you weren’t affordable, but that a bespoke CMS doesn’t generally make sense under that price range.
The issue of turnkey things is that they’re not really turnkey except for the simplest projects. There’s a fair number of people who want a custom site, really do have custom requirements, but whose needs and budget are in the mid-four figures. Turnkey things are fine if they completely fit the client’s needs (I recommend Squarespace to design people who just want a portfolio site all the time), but they’re a pain in the ass when the client says “But I need these few custom things…”. That’s where WordPress and, I think, Craft, play very nicely.
Both can actually do much more than that… but with WP you tend to fight against a lot of cruft. Craft is cleaner and I’m tempted to reimplement a couple of things in it…
I’ve found communication is key when using a turnkey platform, to make sure the client knows we must work within the limitations of the given framework in order to hit a budget number.
A small business that truly has less than 10K to spend on a website almost never needs a custom design/build solution, something like Squarespace is fine, and it is fairly customizable. Plus it takes away a lot of the maintenance headache that comes with WordPress.
I’m interested in the approach The Grid is taking, focusing on the content, which is the correct focus. I’ll have to check out Craft, I hadn’t heard of it before. We’re always evaluating new tools. Thanks!
There are a fair number of people who do, in fact, benefit from custom solutions who don’t spend $50k or even $10k. It might be a blind spot for people at your level but it’s one you should be aware of, frankly because the market doesn’t neatly divide between clients who are either fine with an $8/month Sqaurespace site or should be spending over $10k.
in my experience the market looks more like this:
Turnkey customers. Squarespace, WordPress.com, whatever. They’re fine with a basic site that lets them do a commoditized activity such as write a blog (Evans) or setup a commerce shop (Shopify etc). $0-1000 most of that setup, configuration and basic ‘design’ i.e. color, images and font schemes that look good.
Light customization. Usually something self-hosted, this is almost always a WordPress install on some host with a prewritten theme and a handful of plugins to provide the customization. $1000-$3000 with the upper end being more custom functionality and a design that differentiates the client site so it doesn’t look as much like a template.
Moderate to heavy customization. Self hosted, this is also WordPress but I think Craft fits here too. Custom content types and integration with other services on a custom basis tend to be the hallmark here as well as more sophisticated design. $3-10,000 with the upper range being much more custom in both design and functionality.
Heavy-Fully custom. This is your market. Heavy customization of the admin, more atomic control over content, integration with other services including perhaps internal services, etc.
PS: Craft is at http://buildwithcraft.com. Tutorials are at https://straightupcraft.com.
In the late 90s I created a product/process specifically for small businesses, in the 5K to 10K range.
I think we’re a bit disconnected on process and the value of development time. I can’t even complete the necessary planning components for a thousand bucks. And I never build without planning first.
That said, I’m aware that many folks do web development at very low rates. They shouldn’t, it hurts the industry when people don’t place an appropriate value on their time. We are professionals and should charge accordingly.
If you are setup with Google Webmaster tools https://www.google.com/webmasters/tools/home?hl=en They will give you more detail about why you have been flagged, email you about being flagged, and have an easy way of letting them know you have fixed the issue.
I came to the site to read an article and as soon as the site opened, I got what appeared to be the usual “sign into iCloud” prompt from my device. It looked like the native pop-up and it happens from time to time so, yes, I signed in. And then thought, “Hmmm – I wonder if that was real?” Anyone else see that? I’m wondering if it was a phishing prompt to capture Apple ID info?
I dont do dev for very low rates ($95/hour). But it doesn’t take 20 hours to plan most SMB sites that need some customization. If I spend a day on it that’s $800. Add another day for project management etc and 40 hours of billable time to do a site (remember, we’re talking small sites) and that’s ~$5500 or so.
To put this into perspective, I’ve run dev teams of 40+ and done program management for projects much larger. I’m not at all disconnected on process, I’m just aware of what you can do for small businesses who need more than turnkey and less that a $10k effort if you’re efficient. If you’re NOT efficient and it takes a ton of time to do things in your CMS that’s a reflection on your CMS, not your client.
The CMS integration is the last step in the process, easy and quick. I’ve never run across any firm that does as much up front planning as we do though. We get into content as well, since a website is made of content it matters quite a lot, so that’s part of the process.
I can do a small business site for 5K, no problem, if we use a turnkey platform. A custom design/build project would be 10K minimum. It has to be, if you spend a proper amount of time on planning and design. Of course you can talk to ten people and you’ll get ten different answers on what the proper amount of time is. For me, I like to spend more time planning and designing, which makes the actual development very easy.