We are recently getting a barrage of Joomla 3.2.1 websites that are hacked and need to be fixed. Obviously, someone cashed in on the recently announced vulnerability on Joomla 3.2.1, and fast! We are saying someone (and not some people), because 90% of those hacked websites have the exact same hack: the Google hack! (Or so we like to call it!)
In short, the website will display different content for Google than the one displayed for the users, and that’s why it’s so hard to discover! Eventually, Joomla administrators discover that their websites were hacked because they lose their search engine rankings! Not the best way to discover that a website has been hacked!
So, how can this hack be fixed?
You might be wondering, how come we are insisting on the someone, even though that particular hack can be done in many, many ways? Well, because for all these websites, the hack was done the exact same way: some malicious code was inserted at the beginning of the loader.php file, which is located under the /libraries/ folder. Fixing the hack consisted of simply removing that malicious code (the malicious code is obvious, and it starts before the standard Joomla comments for any particular file).
Is there a way to check if a 3.2.1 Joomla website is hacked before Google knows about it?
Here’s our little secret. We have installed a FireFox extension (on all our machines) called the User Agent Switcher, which allows us to view a website the way it’s seen by Googlebot. If you install this extension on your FireFox browser, you’ll be able to see it the same way Google sees it. We suggest that you do install it, and that you check your website at least once a day with the user agent switched to Googlebot 2.1. This will allow you to quickly discover the problem and fix it before even Google notices it!
If your Joomla 3.2.1 website is hacked, then try the above fix. If it didn’t work for you, then please contact us. We’ll fix the problem for you in no time and for a very reasonable fee!