10 Steps to Remove the WordPress Pharma Hack

One of the websites which I am an admin of, namely City Sikhs Network, recently was the victim of the Wordpress Pharma Hack, which has been around for donkeys years.

However, some of the tutorials on the internet for removing this hack are a bit old now and so are not able to properly clean out the pharma hack (which I think is a little more sophisticated now), so here is the process I followed to purge the website of the Pharma Hack and restore its grace in the search engines within 1 or 2 days.

Firstly let me explain HOW your website got hacked...

How the Pharma Hack Hacked You

• Your WordPress installation may be old, but its more likely that your plugins are old and contain exploits. Two particular plugins which can be exploited are:
• Akismet - Ironically this plugin is meant to stop spammy comments but it is updated regularly and so many people forget to update it to the latest version
• Timthumb.php - This file is usually used WITHIN plugins and so fails to be updated even in some of the latest plugins. At the time of writing the latest version is 2.8.10 and available from http://timthumb.googlecode.com/svn/trunk/timthumb.php
• Public read/write permissions for files and folders (777) on your server are being exploited. Your files should all be 644 (-RW-R--R--) and your folders should be 755 (DRWXR-XR-X).

Symptoms / Diagnosis of the WordPress Pharma Hack

• Google may flag your website as "This site may be compromised"
• Your titles and descriptions of links in Google are starting to look a little pharmaceutical!
• When you go to the actual page it looks OK, and so does the source of the page
• If you go to Google Webmaster Tools are use the "Fetch as Google" feature (under Health) you can see that the title, description and content of the page is injected with pharmaceutical terms and phrases
• Your website is quite high traffic (that is WHY you have been targeted!)

Pre-requisites for Removing the WordPress Pharma Hack

• MySQL Database Backup - You need a backup of your website's database before the pharma hack occurred (I used a backup one month prior JUST to make sure). If you do not keep backups, firstly SHAME ON YOU and secondly ask your hosting company who should be able to help you
• Shell / SFTP Server Access - I discourage you to use FTP as its very insecure. From now on use SFTP via a program like Filezilla or use Shell/SSH. I recommend Shell because we will be using it in our examples and need it to run some commands on the server. On Windows you can access shell through a program like PuTTY.
• Download latest version of WordPress from http://wordpress.org/latest.zip. We will use this later.

10 Steps to Removing the WordPress Pharma Hack

1. Disable and Delete ALL WordPress Plugins - This is a good time to purge WordPress of (1) plugins which are no longer needed and (2) which are needed but are out of date. Keep a note of the plugins which are still needed and then DELETE them from WordPress. This may be a good time to put up a "Sorry, website down for maintenance" sign on your website by uploading an index.html to your root.
2. Purge Any Plugins Files/Folders on the Server - Login to your server through Shell/SSH and navigate to the plugins directory using the command ls to list files/folders and cd ./folder/ to access a particular folder. Once inside the plugins directory, remove all the files in there except index.php. To delete folders you must use the command rm -r folder, to delete files its simply rm file.php. Delete any cache folders within the wp-content folder, and whilst you're at it, any themes that are not in use under the themes folder, and whilst you're at it, any files no longer needed in the uploads folder. We're clearly on a deleting spree! You should just be left with index.php, themes, plugins and uploads folders under the wp-content folder, and the plugins folder should be totally empty (except for the index.php file).
3. Re-download all the plugins from your list directly from http://wordpress.org/ (to ensure they are not compromised) and upload them to the plugins folder (SFTP may be easier for this particular task!). Lets double check to ensure that timthumb.php, which may be inside a particular plugin is upgraded to its latest version here: http://timthumb.googlecode.com/svn/trunk/timthumb.php. So now we KNOW our plugins are OK.
4. Login to PhpMyAdmin and drop your existing database. You may want to reduce the size of the backup before uploading, so you can open the SQL file in a text editor and remove any spammy comment entries under the wp_comments and wp_commentmeta table. Also, this may be an opportunity to remove any tables left by old plugins which are no longer needed. Once you are satisfied, upload your backup. For your reference the core WordPress tables are the following (anything else is not REALLY needed to run WordPress and should be questioned):
•  wp_commentmeta
•  wp_comments
•  wp_links
•  wp_options
•  wp_postmeta
•  wp_posts
•  wp_terms
•  wp_term_relationships
•  wp_term_taxonomy
•  wp_usermeta
•  wp_users
5. Purge WordPress of Corrupted Files - Delete everything on your server EXCEPT index.html (which is currently showing your down-time message), config.php (which is also in the root) and the wp-content folder. Now unzip the freshly downloaded WordPress archive and upload it to your server (making sure NOT to overwrite your wp-content folder!). Ahhh...can you feel the freshness returning already?
6. Fix Any Permissions Security Holes - So now we need to go back to Shell just to ensure our permissions across our WordPress installation are secure. Remember all files should all be 644 (-RW-R--R--) and your folders should be 755 (DRWXR-XR-X). We are going to use two Shell/Linux commands to help us do this. First login to your server through Shell/SSH and then type (or copy and paste!) the following two commands (you may be prompted for your shell password):
• sudo find /path/to/wordpress/root/directory -type f -print0 | xargs -0 sudo chmod 644
• sudo find /path/to/wordpress/root/directory -type d -print0 | xargs -0 sudo chmod 755
7. Reset Permalinks To Restore Website - Now that we are sure permissions have been sorted simply login to your admin backend and go to Settings > Permalinks. Select your existing permalink structure and click Save Changes. You website should start working again, you can check a sample page to make sure by going to the URL directly (as we still have our index.html file remember?)
8. Test Sample Page in Google Webmaster Tools - Lets just do a quick test to make sure the hack has indeed been purged. Log in to Google Webmaster Tools and use the "Fetch as Google" feature to check a sample page of the website that has been known to be hacked. Look at the result's fetched title, description and page content. If all things are well it should be looking like normal again! If not, it may be that:
• (a) The fetch tool may be fetching a cached version of your web page. You should turn off any caching on your website, for example, any Google PageSpeed plugins which may be active. To test if the page is being indexed properly after removing any caching plugins from your server, try modifying some of the page content and see if it appears in the fetched source! If it does, and the titles/description/content are still showing signs of pharmaceutical injection then try (b) below...
• (b) You still have the hack and perhaps need to restore your database further back in time. Since we have properly cleaned the files on the server, no corrupted files can exist on it, so the database can be the only issue.
9. Create a New Sitemaps.xml to Submit to Google & Bing - Once step 8 is successful we need to create a new sitemap to tell Google to restore our titles and descriptions back to normal. You can use a service like http://www.xml-sitemaps.com/ or http://www.freesitemapgenerator.com/ (this is the one I use). I would discourage you from using a WordPress plugin to create sitemaps now and in the future as some of the plugins are known to be easily exploited, and the less plugins you have which need updating the more secure your WordPress installation will remain! After creating your sitemap you can submit to to Google via Google Webmaster Tools OR to both Google AND Bing via the following link (assuming your sitemap.xml file is in the root):
1. bing.co.uk/ping?sitemap=http%3A%2F%2Fwww.yourwebsite.org.uk%2Fsitemap.xml
2. google.co.uk/ping?sitemap=http%3A%2F%2Fwww.yourwebsite.org.uk%2Fsitemap.xml
3. google.com/ping?sitemap=http%3A%2F%2Fwww.yourwebsite.org.uk%2Fsitemap.xml
10. Wait a few days and just like magic your website is restored! Congratulations on restoring & securing your WordPress website now and for the future!!!

Any questions, please leave in the comments...