This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites.

It looks to me that they are hard coded but i have no idea where to delete them or how did hacker get access to my website. Was it through Drupal, or through server ftp or some other way. I have several websites on this server so i guess its possible that all of them are attacked. Checking everything through drupal interface gives me no clue.

What steps should i do to prevent this from happening. Is there any way to find out when did this happen so i can maybe do server backup (websites are static so not much would be lost). Will it be enough to just change server/drupals passwords ?

Any help would be apreciated. Only thing i can think of right now is to put all websites in maintanance mode and wait for help.

UPDATE: With hacked module i found that 4 files were changed:

includes/bootstrap.inc (no change there except 1 extra emtpy line at the end of document)

.htaccess (change is only in non www to www, which i did myself)

robots.txt (Crawl speed default line was removed, nothing else).

includes/theme.inc (here is the change, at line 2704, three lines added).


"$variables['page_bottom'] .= '<div class="_all_wplink_2CUJ7TnE_cc"style="position:absolute;left:0;top:0;opacity:0.001;z-index:10;filter:alpha(opacity=0)">Don\'t pump.... here comes bunch of links."


Line 2 is huge and contains bunch of spam links. Easy to fix this but no idea how to prevent from happening again, how did hacker got access to server. Please advise.

  • try the Hacked! module.
    – No Sssweat
    Nov 4 '15 at 3:01
  • I'm afraid we can't guess from here how your server was compromised. If Drupal was to blame, it's quite likely because of the vulnerability outlined in the duplicate. If it wasn't, you need to get someone to audit your server security and tighten it up (the same person might be able to tell you how the attacker initially got in)
    – Clive
    Nov 4 '15 at 18:42

Browse other questions tagged or ask your own question.