Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How do I deal with a compromised server?

WP Site (up to date with version & plug ins)
Cheap budget host

Inserted on all of my pages inside the tags are the following code

Fast Cash Advance Fast Cash Advanceif(document.getElementById('hideMe') != null){document.getElementById('hideMe').style.visibility = 'hidden';document.getElementById('hideMe').style.display = 'none';}

How do I remove this?
What steps can I take to prevent this from occurring again?
How can I identify the susceptible area?

Thanks.

share|improve this question

marked as duplicate by Zoredache, mfinni, EEAA, jscott, mdpc Jan 10 '13 at 3:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Wipe the system, restore from your backup, fix the problem. –  Zoredache Jan 10 '13 at 2:44

1 Answer 1

up vote 2 down vote accepted

How do I remove this?

  • You need to restore from some backups.

What steps can I take to prevent this from occurring again?

The best ways which you can reduce the chance of getting a WP site hacked:

  1. Change db table prefix to something else from WP default
  2. Change WP default admin username to something else which no one can easily predict
  3. Change the default admin dashboard (/wp-admin) URL to something else, using .htaccess rules, which nobody can predict easily. If you are confused with .htaccess rules, use some addons like stealth-login

Actually, if this is just a WP hack, ideally you don't need to wipe out your entire system. Since, you don't know whether its a complete server hack or not, it is better to wipe out completely and restore from backups.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.