Help! All Website Menus Go To Some Strange Website

[guybower1]

I went to my website and clicked a menu item and the next thing I was at some strange site. On going back, all menu items behaved the same. I contacted friends to ask them to also try it and they got the same result

We run protection plugins on our site, so I am not sure what it is.

Any suggestions at all?

cheers

[ruenel]

Hello @guybower1,

Thanks for reaching out.

1.) Please go to X > Google Analytics and remove the analytics code because you have inserted it incorrectly.

This should remove the broken code displaying on top of your page.

2.) In your homepage, you have added this invalid button link:

<a href="https://wordpress-102462-558755.cloudwaysapps.com/food-tours">[x_button id="btn-viewtours" size="global" type="flat" shape="pill" size="regular" style="color:#fff;background-color:#fe5000; padding-bottom: 8px;" href="https://feastthailand.com/food-tours" title="Food Tours" target="blank" class="btn-viewtours"]VIEW TOURS NOW[/x_button]</a>

You should only be using the button shortcode:

[x_button id="btn-viewtours" size="global" type="flat" shape="pill" size="regular" style="color:#fff;background-color:#fe5000; padding-bottom: 8px;" href="https://feastthailand.com/food-tours" title="Food Tours" target="blank" class="btn-viewtours"]VIEW TOURS NOW[/x_button]

Kindly make all these changes, make sure to clear all your plugin caches and purge the site cache in Cloudflare before testing your site again.

[guybower1]

Cheers Ruenel

I appreciate your reply, though none of those observations have anything to do with the actual site hijacking that had happened. Every menu was redirecting to some sort of spam site on every click. I restored the site from Updraft Plus and it is now fine. I have also change the password to one which is hopefully more secure

It’s odd re GA, as that GA code was input way back when the site was initially created, so a few years ago now. I have now removed it from the meta tag area.

The button code has obviously kept the staging server address in it when the update was copied across from that server. At the time, though, that code was correct, though of course the URL was of the staging server and not the live site. I’ve updated it to the more recent code now used, so thanks for the heads up

cheers

[friech]

Hi @guybower1,

Is it confirm that the site is being hacked? Or maybe something on recent edit on your site got messed up? if it is the former, I advise that you update all your site credentials and update all plugins, themes, and WordPress itself to the latest version, then install a security plugin like WordFence.

Hope it helps,
Cheers!