When a hacked site isn’t a hacked site

Google News can experience problems with news items if their titles only appear as links. So my news sites always have a h1 header with a separate permalink to the article.

So when developing one news site today, I was shocked to find a couple of posts had links in them to a third party site.

I use Wordpress as my news CMS of choice, and have had a couple hacked before. So I looked for the telltale signs of a hacker - a section of code in javascript or an iframe near the page footer. None present.

So I looked more closely at the page code and found no anchor link around the post titles in question. Odd.

I figured maybe it was a global replace - both posts were about Nokia, so there’s a keyword replacement if I ever saw one.

I checked the index file for inserted php code - none present. So I checked the dates of my top level Wordpress files, and finding nothing, checked the dates on my wp-include files. All were clear.

I realised the install was out of date, so upgraded Wordpress.

NOTE: I save two versions of the latest Wordpress releases: one with all files for new sites, and one with the templates removed for established sites, after overwriting customised templates on one install.

Wordpress updated - and the links in the titles were still there.

Shit - I must have some spyware installed - I’m surfing today with no anti-virus as my update with McAfee hit a bug and wouldn’t activate. Maybe it’s that?

I take one more look at the code…

…and found the cause.

Turned out all that had happened is that a link used as a reference in the above post had been left as a note at the bottom. With an open anchor tag.

Deleted the couple of instances where it had occured, and all was fine again.

All that hassle for an accidental bit of invalid HTML.

It’s always the little things that throw me…