I think My Site Has Been Hacked

[fazza47]

I am working with a client and have noticed lots of 500 server errors that look very strange in their webmaster tools account.

I am seeing URLs like this blog/?tag=wholesale-cheap-nfl-jerseys-free-0702.html and blog/?tag=nike-jersey-shorts-4297.html

there are 155 similar pages yet the client does not sell anything like this and hasn't created these URLs.  I have updated WP and all plugins and cannot find these links or pages on the site anywhere but I am guessing they are slowing the site down as GWT keeps highlighting them as errors.

Has anybody had any experiences with these types of hacks and can point me in the right direction of how to clean it up properly?

Ta

[kwoolf]

If they are tags then they should show up in the tag section of Posts or possibly in the comments. Not sure if you allow uploads to your site, but if you do you should check out the upload folder(s). Keep in mind, these URLs could be showing up somewhere out in cyberspace, not necessarily on your site. Take those steps I pointed out and you should see those ugly URLs go away within a few weeks, not accounting for other factors.

[fazza47]

Woudl I be able to see this from the Dashboard as in by clicking the tags section or would they be hidden?

[kwoolf]

No! Sorry, SajeetNair. No disrespect here but don't click on these URLs. That's exactly what spammers want you to do. Simply follow the tips outlined in my post and these links will be ignored. Or better yet, disable any tag feature on your client's blog.

[kwoolf]

Looks like somebody or somebot is using your tag widget to tag your pages/posts with their dirty links. If you really need this tag feature, I suggest you make sure any links posted have a rel attribute of nofollow, and I'd add that /tag directory to your robots.txt something like this:

User-agent: *
Disallow: / *?tag

Also, login to your webmaster tools and add URL Parameters to let engines know to ignore these pages.

[SajeetNair]

First click on one of the URLs and see the pages from which they are linking from. If its an internal link then check the source code and rectify the error. If its an external link then the third party website needs to be contacted and the links must be removed.