Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search queries. But somehow I still see spam data when I search for the two main words in the domain - see link to domain above - as meta descriptions for certain pages. I have not been able to find the source. Not all anyways. I wonder what I am missing. Google should have cleaned up its records since last week so there is probably still spam. How can I - without reverting to an older backup - find it? Where does all-in-one-seo store its data - used by client- ? Perhaps that is where the spam was added to the database.. Or where could the meta description be loaded from? So far I only found spam event calendar pages (WordPress plugin - link ), but those I removed and the plugin has also been updated. Really want this solved asap as I do not want it blacklisted and look bad in general

share|improve this question
add comment

1 Answer 1

All-in-one SEO Pack stores data in the wp_postmeta table (or xyz_postmeta if your WP prefix is xyz_). Meta values that correspond to the plugin are prefixed in the meta_key column with _aioseop. Of particular interest in this case for <meta> tag spam will be the following meta keys:

_aioseop_title
_aioseop_description
_aioseop_keywords

A select like the one below should give you a fair idea of what you'll have to remove:

SELECT meta_id, meta_value FROM wp_postmeta WHERE meta_key LIKE '_aioseop_%'

share|improve this answer
    
Thanks Gman. I used your query with the adjusted prefix. I did find the meta description shown on the page itself (as well as all others). It is clean and not like the meta description shown in Google for that page with the viagra spam. So where else can the meta description be loaded from? –  rhand Dec 20 '11 at 8:47
    
Try grep -RHn 'spam_pattern' ./* (assuming you're inside your webroot) –  Garrett Dec 20 '11 at 16:00
    
$ cd domain.com $ grep -RHn 'Viagra' . $ grep -RHn Viagra . $ grep -RHn Viagra ./* Returned nothing, but it is shown in Google under one of the pages. –  rhand Dec 27 '11 at 8:55
    
And what is the n for in the grep command? –  rhand Dec 27 '11 at 9:17
    
After a fix of the Events Calendar after an upgrade I think I might have solved the issue. But will keep a close eye on Google's latest crawls –  rhand Dec 27 '11 at 10:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.