More information on Pharma Hack on WordPress

UPDATE:  This is an update post – the first one can be found at Pharma Hack Fix for WordPress.

Its been a fun few days as I have been “fighting” with a hacker/black hat SEO person trying to use my blog to sell viagra.  But my friend David and I were able to catch the, with their hand in my wordpress cookie jar.

How did they do a Pharma Hack on WordPress

Basically they compromised the server somehow – I have not figured out which method yet. But it appears they have/or had FTP access.  There were two files uploaded:  auto.php, keyboard.php and one item modified: wp-load.php.

Each day the hackers upload a new version of the file.

So, for the first 2 days I left the FTP the same…I just wanted to see how the hacker was gaining access.  I didn’t figure it out – but I simply changed permissions and that didn’t help.   Tonight I changed the FTP password – so we will see if that helps.

How to fix the Pharma Hack on WordPress

I’m not sure I know yet.  The first thing I have done is add a 301 redirect from auto.php and keyboard.php to my latest post regarding this issue.

RewriteRule ^auto\.php [R=301,L]
RewriteRule ^keyboard\.php [R=301,L]

This will allow me to capitalize on the hack and not allow the hacker to steal all the traffic.

Stay tuned

We will see how this comes out – I need to inspect the plugins – it seems like it is the obvious solution.

Thanks for reading.

Private WordPress – wp

If it is not clear by now – I love WordPress.  I have been involved in documenting many, many web applications.  One way I have found ease in this is using WordPress as the medium for the documentation.  If this sounds interesting – check out this plugin called Private WordPress.

Pharma Hack Fix for WordPress

Pharma Hack Fix for WordPress

Pharma Hack Fix for WordPressI really thought I was doing a good job…starting build my traffic back up to the levels I had seen about 18 months prior, then I saw my numbers drop.  I had been hacked – someone was replacing my links/Google descriptions and sealing my search links and link juice.

My Pharma Hack Fix for WordPress

I’ll be detailing out what happned – how I found it and all the gory details soon.  The short-short answer was the hackers had added a “auto.php” and “keyboard.php” to my root – then modified the “wp-load.php” file to do all their bidding.

Hacking Backlinks

Albeit very Black Hat SEO, the hackers who hacked my WordPress server were very smart and had a very elaborate plan.  They were using many hacked servers to drive links around to high PR (Google Page Rank) sites and creating better link juice.  I’ll explain more in  an additional post.

The Hack – Phase I

It is really a brilliant plan.  If it weren’t so illegal – it would be perfect.  As far as I can tell, they employee a 3 stage process.  (Thanks for the help figuring this all out from my friend David, who is a super knowledgeable dude with this sort of stuff.)

The system has three components –  encrypted php in antu.php and keyboard.php (my guess these files could be named almost anything) and then another bit of encrypted code in wp-load.php.

Notice all the links and then the URL’s

auto.php & keyboard.php
This is used to suck current SERP traffic from google.  With this “auto.php” and “keyboard.php” they are cloaking the Google bot – so basically, when people search google for my content or search google at all and return results – it it redirects to a site selling Viagra or Cialis.

If you take a look in Google Webmaster Tools you will see how effective they have been.  There are all kinds of links for these terms.  Its crazy – very impresive really.

Not cool – but look at how effective they ahve been…check out those stats.

But they also employ a second tool – in the “wp-load.php”.  I think this is what communicates back to the mothership and allows them to manipulate SERPs and URLs the way tehy do.

See the encrypted code here: (same thing you will find in auto.php and keyboard.php)

Encoded black hat SEO code

So what the heck is a guy to do?

Well – good question.  This is where my buddy David comes to the rescue.  His SEO knowledge/instinct told us not to waste this huge spillage of Google Juice.  If they want to give us lemons – we’ll make some good old fashion SERP lemonaid.

301 Redirects & commenting out some code.
We added two lines to the .htaccess file and started to redirect all the traffic from those links to this post.  Hopefully – that is how you found it.  :)

RewriteRule ^auto\.php [R=301,L]
RewriteRule ^keyboard\.php [R=301,L]

By adding these – we have reversed the outward flow of traffic.

Then – for the wp.load.php
For this guy I simply commented out the  section circled in blue above.  It does appear that the SEO hackers do try and keep fixing this issue – I am testing a few things here.  I am trying to figure out if they have FTP access – or are simply using a vulnerability of a plugin.

Non WordPress Hacks

After looking over all the results of these files in Google – it certainly appears that this reaches much further than simply WordPress.  It appears to be links to many Apache/PHP sites.  It certainly seems the base of the hack is the same – look for auto.php, keyboard.php – then for a file modified on the same day as those two and I think you fill find the culprit.

Please let me know if you need help…I will assist if I can.



This has been a wild day, but fun all in the same.  It is very interesting how smart some people are.  This is a engineering marvel – this is not some fluke, this this is serious – don’t think so…so a search for auto.php and keyboard.php and see how widespread the carnage…very impressive.

Let me know if you have comments or have been bitten by this bug.

Andrew Warner

Mixergy is great

Andrew WarnerIf you like podcasts and startups – then you have to check out Mixergy.  Mixergy is the brain child of Andrew Warner…he publishes a handful of interviews each week.  YES, each week.  They cover all aspects of the startup world from funding, to idea generation, to success management to failure.

One of the most compelling series he has done over the last few months was teh one on failure – wow, how refreshing to have entrepreneurs talk openly about how they have fails.  What a great set of podcasts.

I guess I just wanted to drop a note out there about how much I enjoy Mixergy and encourage anyone who has an opportunity – to check it out.

Article Marketing – Google Demands Quality

The Google Farmer update targeted article directories and content mills. It went after sites, which used duplicate content and low quality articles. As many are aware, the vast majority of articles on article directories are extremely poorly written. The entire focus of Google’s update was to improve the overall quality of search results for users. Since these sites were notorious for less than promising results, they were the ones targeted.

The main problem with this reasoning is legitimate sites used these directories too. Article marketing helped sites increase traffic and exposure, while providing useful content to readers. However, this content often got lost in the midst of the lower quality articles. If you associate with bad content, yours must be of the same ilk, right? No, but Google didn’t take the time to sort things out. Instead, you got the Farmer update and all the havoc it wreaked.

What confused everyone were the results of the update. Some sites noticed an increase in traffic. Another group wasn’t really affected. This group probably didn’t use article marketing quite as much as the other groups. Other sites noticed a significant drop in traffic and their page rank. How could a single update affect sites so greatly, especially when they all used article marketing?

The answer is relatively easy, but still confusing. While millions of children play with toys, they don’t all play the same way. Some have high energy and like action toys, while others prefer quieter activities. The same goes for article marketing. It’s all in how it was being used.

How To Please Google

Before you try to figure out the intricacies of article marketing after the Google Farmer update, look at what it takes to make Google happy. This makes understanding the effects of the update much easier. As you probably already concluded, Google is after quality. High quality makes Google happy. A simple solution, but it requires quite a few elements before you are considered “high quality.”

The first area to master is grammar. Believe it or not, Google looks a spelling, basic sentence structure and overall flow. If the article has numerous mistakes, it is immediately dismissed as low quality. Pass this check and you are one step closer to success.

The next area is keywords. Keywords are what draw search engines to your article. A user searches, Google sees the keyword and the article displays as a result. What many do wrong is stuff their articles with keywords. Either they use the same keyword repeatedly or try to use numerous keywords, which make the article come off as disjointed. Instead of content, all you end up with is keywords. Use keywords sparingly and always write for the reader, not the search engine.

Relevancy is next on the make Google happy checklist. Much of the content on article directories has nothing to do with the sites they link back to. An article on the best golf clubs for ladies may link back to a dating site. When readers click the link, they expect to find something dealing with golf clubs. Instead of staying on the site, they leave. Sites tricking visitors hope they will find enough people who will stay, that it’s worth placing random articles up. Google demands the article be relevant to your website. Readers will appreciate it, so it is always a good policy to create articles, which focus on something related to what your site offers.

The final area you need to think about is originality. Before the update, you could submit the exact same article to every directory with no real problem. Others could republish this same article. The result is a single article, which can be found on numerous sites. For readers looking for more information, all they can find is the same article. This is why Google wants articles to be unique. Sites using duplicated content are frowned upon. You can use the same topic and something close the original article, but every time you submit the article, rewrite it enough to be unique.

Of course, there are a few other minor things, but overall, if your content meets these requirements, you are well on your way to ensuring Google looks favorably upon you. The only one, which is difficult to master, is originality. You may be able to submit a different article to each directory, but it doesn’t stop others from republishing it.

Google does have a loophole, which takes the other factors into consideration first. If you have high quality content, which is then republished, both sites then have high quality content. Since you have submitted a different article to each directory, you cut the amount of duplication. The combinations of high quality content and limited duplication allow you to still increase your page rank without punishment.

After everything Google did to upset the world of article marketing, it is the least they could do. Basically, follow the rules and Google will let you continue using article marketing.

What About The Directories?

At this point, you have to be wondering what’s the point of article marketing if the directories can’t be found. Directories have now blatantly divided. You have your good and your bad. The good are changing their submission requirements to only accept high quality articles. In some cases, they are even removing content, which doesn’t meet these standards.

This gives them an advantage. Instead of being seen as an article directory, it is simply a site with a wide variety of high quality content which is update daily. The site is constantly indexed and the content keeps the site’s rank high. Regular searches quickly reveal which directories have gone the extra mile to stay on top after Google’s update.

When it comes to choosing which article directories to use, only use the highest quality ones. These are the ones reputable sites go to for content to republish. These are the ones, which will actually get your article listed in the first few pages of search results on Google. Basically, these directories are the only ones who offer any real benefit to your site. Other directories are a gamble at best. Why waste time on directories, which may end up hurting your site.

Another way to choose a viable directory is to read some of the content. If you find yourself trying to make sense out of basic sentences, the content isn’t Google material. If this appears to be the majority, then submit your content elsewhere. Leave the poor quality content to directories that don’t care about what is submitted.

Article Marketing Wins

Despite what some may tell you, article marketing is not dead. It is just more effective. Those who keep preaching about the demise of article marketing are likely those who used it incorrectly in the past. It’s easy to take the route many sites teach, which is the same method used by spammers. If your site is legitimate, all you have to do is change your technique. This sets you apart from the spammers.

Change does take work, but your work pays off better than ever. You have to make the choice yourself whether or not changing is worth your time. If you would rather use other marketing methods, this is perfectly fine. Some site owners have become so discouraged over their site’s drop in rankings that article marketing is definitely not their favorite topic.

It’s important to try to keep a positive outlook. If your site took a major drop, then it will take time to recover. If your site was unaffected, you have nothing to lose. Revamp your article marketing and benefit from Google’s change. If your site improved, keep doing what you were doing. Odds are, you were already employing the techniques Google was looking for.

While there are plenty of options to choose from to market your site, article marketing is one of the most popular for a reason. It’s cheap, sometimes free, and it works. It gets your site the right kind of visitors, the visitors that not only stay on your site, but also click ads, buy products and purchase your services. Since article marketing takes little, there is everything to gain.

Don’t let anyone tell you Google is the death of article marketing. As long as you do it correctly, it is still one of the best ways to market your site. Continue using article marketing and you will see your site’s rank increase, despite the changes Google may throw our way in the future.

Author: Pat Tate

As a senior Pat Tate started to explore Internet Marketing. She uses her blog as a journal to keep track of the people and programs that she has met along the way. Grandma’s Internet Marketing/blog

She is an avid golfer and invites women to join her to talk golf at Women’s Golf Center

She has always loved toys and as the proud Grandmother of five beautiful Grandchildren she gets to play with new ones. Grandma’s Toy Review