Author Topic: I removed all malware from my site but it's still being blocked as phishing  (Read 685 times)

0 Members and 1 Guest are viewing this topic.

Offline kperry19

  • Newbie
  • *
  • Posts: 1
My Wordpress website kofiperry.com got hacked a few days ago and since then I've taken many measures to fix it. I replaced all the unnecessary files, updated my theme and all plugins, deleted all my unused pages and comments, reset my passwords, and then installed Wordfence to scan for the rest of the infection and delete or repair those files. Now when I scan for infections I don't get any results, and when I access my website without Avast web shield enabled it seems perfectly fine. But with web shield enabled I get:

"Whew! We’ve just saved you from an infected website

Infected URL: https://kofiperry.com/

Threat: URL:Phishing"

What's weird is Avast doesn't block it every time, only some times. And less using Chrome than Firefox. Can anyone help?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87085
  • No support PMs thanks
Re: I removed all malware from my site but it's still being blocked as phishing
« Reply #1 on: September 26, 2022, 12:02:03 AM »
Use the - Reporting a Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php.
You should get a response in a day or two.

Avast is not alone in detecting this - https://www.virustotal.com/gui/url/127c2cf428eefee81409cd87676e190a911bd8377567aea1377ab427337d7834?nocache=1
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33582
  • malware fighter
Re: I removed all malware from my site but it's still being blocked as phishing
« Reply #2 on: September 27, 2022, 03:31:09 PM »
Your CMS implementation seems OK, but a security headers scan reveals,
that you or your hoster should work on your/ their security posture immediately:

See: https://securityheaders.com/?q=http%3A%2F%2Fkofiperry.com%2F&followRedirects=on

Same results here as DavidR reported: https://www.virustotal.com/gui/url/340f81aa4d3a9dc39bad89da66bdf953773f331c67719907413a9b2c80defcef?nocache=1

Missing Headers:
Quote
Strict-Transport-Security   HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. Recommended value "Strict-Transport-Security: max-age=31536000; includeSubDomains".

Content-Security-Policy   Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.

X-Frame-Options   X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN".

X-Content-Type-Options   X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".

Referrer-Policy   Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.

Permissions-Policy   Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!