Member Avatar for Member #229973

:@ ( Help me out on this I dont understand how it happened but my key words have been hijacked.
My site is http://www.joylandsafaris.com - is developed using joomla 1.5.10. When I Google the site, the key word header is not what I have set but the hijacked content.
Somebody help me :'(
Thanks

  • 4 Contributors
  • 8 Replies
  • 226 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by insaneoz

Dani AI

Generated

Short diagnosis, then a focused cleanup checklist.

This looks like classic SEO-spam/title-hijack caused by a compromise of a Joomla 1.5 site: Joomla 1.5.10 had publicly patched XSS issues (1.5.11 was released to fix several problems), and attackers often inject spam into templates, language files, the database or add hidden pages/backdoors that only show up to crawlers. Take the site offline or enable maintenance mode, make a full file+DB backup for forensics, and treat the site as compromised. (joomla.org)

Verify what Google actually sees (don’t rely only on the browser view). Check the live HTML and compare it to what Google crawls:

  • View the page source in your browser and confirm the <title> tag and visible H1.
  • Use the URL Inspection / Cache in Search Console and fetch the page as Google (it may show different content).
  • From the server or SSH, fetch the page with different user-agents to detect cloaking:
curl -sS -A "Mozilla/5.0" https://example.com | sed -n '1,120p' | grep -i '<title'
curl -sS -A "Googlebot/2.1 (+http://www.google.com/bot.html)" https://example.com | sed -n '1,120p' | grep -i '<title'

Google may rewrite titles from other page elements or anchors; if injected spam appears only to crawlers, that’s a strong sign of cloaked SEO spam. (developers.google.com)

Hunt for injected code and backdoors. Look for recently modified files, PHP obfuscation and suspicious includes:

find . -type f -name '*.php' -mtime -30 -ls
grep -R --include='*.php' -n -E "base64_decode|gzinflate|eval\\(|str_rot13" .
grep -R --include='*.php' -n "preg_replace.*\\be\\b" .

Also inspect .htaccess, check the database for unexpected rows/pages, review Joomla admin users, and search for unknown cron jobs. Use a server-side scanner (or a reputable service) and keep a copy of the infected backup for investigation. (elementor.com)

Clean and recover: restore clean core and extension files (replace, don’t try to edit core hacks), remove injected DB content, delete unknown users, remove extra files, then rotate ALL credentials (hosting, FTP, DB, Joomla admin) and update Joomla/core extensions to patched versions. After you’re confident the site is clean, request a review in Search Console so Google can remove the spammy title from results. If this feels beyond comfort level, use a professional site‑cleanup service. (joomla.org)

Notes tied to the thread: ’s prompt to check the title tag is exactly right — start there. and were also on the right track; follow the steps above before contacting Google for a review.

Recommended Answers

All 8 Replies

Member Avatar for mrandrei

Oh, that's so bad. I don't have any idea why your title tag changed. Did you revise it recently?

Member Avatar for Member #229973

Oh, that's so bad. I don't have any idea why your title tag changed. Did you revise it recently?

Thanks, no I havent touched them apart from now as I try to get rid of the obscene header words tho in vain

Member Avatar for bobchrist

What do you mean by keywords header hijacked? Google might be showing the old cached results if you're using expired domain name.

Member Avatar for bobchrist

What do you mean by keywords header hijacked? Google might be showing the old cached results in case you're using expired domain name.

Member Avatar for Member #229973

on the contrary, the domain is still valid. Upto three weeks ago all was well then it got hijacked and the cache results changed. I have tried to resubmit and even the last crawled results still same results.

Member Avatar for bobchrist

I think you should contact google and inform this episode.

Member Avatar for Member #229973

Well, thanks.

Member Avatar for insaneoz

Hey i didn't get what do you mean by header keyword? I know Google takes sometimes long to update the website because they update their website only once a month. change it and monitor it change your password. I think it something wrong with the codding. Check your website codding just in case you need to make some changes.
Try different keywords for searching your website. are you advertising with Google like adword. It usually updates your website faster that way.
Insaneoz

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.