Joomla 3 and Google Security Issues - Security Issues

Question

I have site on Joomla 3.6.2 Stable. In this week I get mail from google about "Security Issues". When I login to webmaster tools there was this message

Hacked with spam

A hacker may have modified your site to contain spammy content. To protect visitors to your site, Google’s search results may label your site’s pages as hacked. We may also show an older, clean version of your site. Learn more

URL injection

These pages appear to be created by a hacker with the intent of spamming search results. http://www.mysite.com/13-basis-32054.pdf
http://www.mysite.com/48-gem-19846.pdf
http://www.mysite.com/superstructure_ili/9.jsp

On site I'm using standard .htaccess shiped with Joomla package and I have enabled "Search Engine Friendly URLs" and "Use URL Rewriting"

When I add something after http://www.mysite.com/ thats contain valid article ID this article is returned. e.g.

When I go to http://www.mysite.com/13-basis-32054.pdf I get article with ID 13 and with http://www.mysite.com/superstructure_ili/9.jsp I get article with ID 9.

There is way to redirect (or disable) all url than doesn't appear in my menu to 404?

---

---

EDIT

Maybe some clarification.

My problem is joomla at standard have something wrong with url rewriting. e.g http://www.timetoinvest.ca/ (I found this site on google) there is no link on site to http://www.timetoinvest.ca/22 but they have http://www.timetoinvest.ca/legal (and when you go to http://www.timetoinvest.ca/AnyStringYouWant/22-evenWith spaces and prefix.html site have title Legal), which (as I think) have ID 22 in system. In conclusion: Joomla standard (.htaccess shipped with install package) rewrite rules lead to showing articles if you enter valid article ID after slash.

So, I want to disable/fix this (described above) behavior, I want to make Joomla to redirect urls which don't exist in menu to 404.

---

---

EDIT2

As Neil Robertson and garth sugests I use myJoomla.com and my site is clean and from the beginning I'm using OSMap plugin (successor of Xmap) and ofcourse it's added to webmaster tools, there is no duplicates in sitemap (I re-generated it and nothing changed) and and all links are SEO friendly.

I think that google reported links are com from hacker site fetch by google crawler.

In message in webmastertools there is section

Here’s how to fix this problem:

1. ...
2. Look for other compromised pages or files on your site
   Fetch as Google
3. ...
4. ...
5. ...
6. Submit a reconsideration request
   Reconsideration Request

When I use it with http://www.mysite.com/13-basis-32054.pdf url it showing Offer site (which have ID 13) and I can't submit reconsideration request in google webmastertools because for google it's spam.

So, I'm not concerned about duplicates, but about I can't tell google that my site is OK.

Here are part of OSMap generated sitemap (with little edit)

Question is: How I can redirect url which doesn't exist in menu to 404 page?

Answer 1

Redirecting the links is probably a short term solution at best.

Ideally you need to find and fix the hacker's point of entry (e.g. update Joomla and all third party extensions to the latest versions) and fix or remove all the malicious files from the website.

Unless you are experienced at this sort of thing, it is probably best to use a commercial scanning service like mysites.guru or sucuri.net or pay someone to do this for you.

Answer 2

Hacking Exploit

I'm assuming that you have sorted out the hacking exploit on your site first... if not, a site like myJoomla.com can help, and after ensuring you have scanned your site thoroughly and upgrading core and plugins, I strongly suggest you use Akeeba Admin Tools and Akeeba Backup (I gain nothing from these recommendations).

Joomla IDs and Duplicate pages

Now onto your main question... Joomla's SEF URL page writing process includes the item ID and any specific additional variables required to create the page as per the setup in each the menu, with defaults from the category.

This is core to the way Joomla works. Joomla's menu structure is very powerful if you learn how to use it. Correct use of visible and hidden menus will generally replace any IDs in URLs if you wish it to be so.

I am at a loss as to why you are looking to try to block this, particularly if you have blog/category posts for which you won't be creating specific menu items. Is it because you are concerned that Google has or will index multiple pages with the same ID, thus causing duplicates in the index and lowering index ranking values?

To see if you have duplicates install the Xmap plugin, and remove all blank categories and extraneous items from your Joomla install. This will resolve most of them.

For a more detailed explanation of removing duplicates I suggest you read my answer regarding this at How Can I Get Rid Of Category Pages in Joomla

Additionally, there are other good resources available by searching "duplicate Joomla pages".

EDIT 1

From what I can gather, you are referring to links to another Joomla site that you have found on Google which you believe are (now) incorrect links and should go to a 404. Also, you are then saying this leads to the possibility of URL injection and that it shouldn't be allowed on a Joomla site (or are asking how to stop it).

But I just don't see why this is an issue, or how stopping this is productive. There is no danger in allowing people to insert a ID number of a page which (if it exists) will load that page. But there is no reason for people to be doing so*, and it won't happen unless you have not shut-down duplicate links on your site, and Googlebot has incorrectly indexed a link.

For proper link management - google "removing duplicate Joomla pages" and read up on that.

If you really want to redirect all 404s (including misspelt links etc.) then see Redirecting all 404s to Joomla Properly

*Security: If you properly secure your Joomla site hacking exploits via URL injection is not going to be an issue.

But I just don't see why this would be an issue for you.

Answer 3

Have you viewed the source code on those pages, in particular the "fetch as Google" vesions? Most hacks for SEO spam will not make the links visible to the user, as they are just for the search engines.

Your priority needs to be to make sure that it is definitely a false positive by Google. Patching after the event will not remove any backdoors - compare your files with those of a fresh Joomla install in order to make sure any differences can be accounted for.

If the hacker was attempting to host malware rather than add SEO links, then it is more likely that the hacker has tried (but failed) to upload files to these locations.

Most hacks are automated, so it may be a case that a hacker has not checked that they have been able to upload their files to a site before sending spam links to their hacked pages. The hacker's tools may just say that the page exists, so the hack was successful (rather than the page exists due to how Joomla works).

If I was you, I'd just use .htaccess to return a 404 on these 3 specific pages (if the site definitely is not hacked, that is). I see no reason to try and rewrite how Joomla works - that seems far to excessive to solve this problem.