WordPress Hacked with Gambling Spam & Redirects: 24-Hour Emergency Cleanup Guide

In Malaysia, thousands of business and government WordPress websites fall victim to malicious online gambling syndicates every year. Known commonly as the Judi Online / Slot Gacor Hack, attackers inject thousands of spam landing pages, hidden keywords (e.g., “slot online”, “kasino live”, “toto 4D”), and conditional mobile redirects into vulnerable sites.

The symptoms are insidious: your homepage looks completely normal when you open it on your desktop, but when a prospective customer visits via Google Search or a mobile browser, they are instantly redirected to an illegal gambling portal.

Here is the battle-tested, 24-hour emergency incident response protocol to clean, restore, and harden an infected WordPress site in Malaysia.

---

The 24-Hour Emergency Incident Protocol

+--------------------------------------------------------------------+
|                   24-HOUR CLEANUP TIMELINE                         |
|                                                                    |
| Hour 0-1: Quarantine & Backup  --> Hour 2-6: Filesystem & WebShells|
| Hour 7-12: Database Sanitation --> Hour 13-18: Reset Keys & Salts  |
| Hour 19-24: Google De-indexation & WAF Hardening                   |
+--------------------------------------------------------------------+

---

1. Hour 0–2: Immediate Quarantine & Forensic Snapshot

Do not immediately delete files. First, isolate the infection to prevent attackers from overwriting logs or re-infecting clean directories.

Step 1: Put the Site into Maintenance Mode via .htaccess

Block public and bot access while allowing your own office static IP:

# Emergency Quarantine in .htaccess
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^123.456.789.000$ # Replace with your IP
RewriteRule ^ - [R=503,L]

Step 2: Take a Complete Raw Forensic Backup

Connect via SSH and capture the current state:

# Create forensic archives for audit
tar -czvf /home/username/infected_backup_$(date +%F).tar.gz /home/username/public_html
mysqldump -u db_user -p db_name > /home/username/infected_db_$(date +%F).sql

---

2. Hour 2–6: Hunting Backdoors & Malicious PHP Payloads

Gambling spam malware relies on stealthy webshell backdoors (e.g., wso.php, alfa.php, or obfuscated eval(base64_decode()) scripts) hidden in wp-content/uploads/ or core system folders.

# 1. Find all PHP files inside wp-content/uploads (There should NEVER be legitimate PHP here)
find /home/username/public_html/wp-content/uploads/ -type f -name "*.php" -exec ls -la {} \;

# 2. Search for obfuscated execution patterns across the filesystem
grep -rnw '/home/username/public_html/' -e 'base64_decode'   --exclude-dir={wp-content/cache,node_modules} | grep -E 'eval|gzinflate|str_rot13'

# 3. Find files modified in the last 7 days
find /home/username/public_html/ -type f -mtime -7 -name "*.php"

Replace WordPress Core and Clean Plugins

Never attempt to manually clean core files. Completely replace them with fresh, pristine binaries:

# Verify core file integrity using WP-CLI
wp core verify-checksums

# Force download pristine WordPress core files
wp core download --skip-content --force

# Reinstall all plugins from official repository
wp plugin install $(wp plugin list --field=name) --force

---

3. Hour 7–12: Sanitizing Database Injections & Rogue Admins

Attackers frequently inject JavaScript redirects into the wp_options table or create hidden administrator accounts.

# 1. Audit all registered administrators
wp user list --role=administrator

# 2. Delete any unfamiliar admin user immediately
wp user delete [SUSPICIOUS_ID] --reassign=[YOUR_ADMIN_ID] --yes

# 3. Search and destroy gambling keywords in wp_posts and wp_options
wp db query "SELECT ID, post_title, post_name FROM wp_posts WHERE post_content LIKE '%judi%' OR post_content LIKE '%slot%' OR post_content LIKE '%gacor%';"

Clean malicious conditional redirect scripts injected into your theme header or footer:

-- Check siteurl and home URL integrity
SELECT * FROM wp_options WHERE option_name IN ('siteurl', 'home');

-- Check active transients for hidden redirect scripts
SELECT * FROM wp_options WHERE option_name LIKE '%transient%' AND option_value LIKE '%eval(%';
DELETE FROM wp_options WHERE option_name LIKE '%transient%' AND option_value LIKE '%eval(%';

---

4. Hour 13–18: Key Rotation & Session Invalidation

After purging all infected files and database records, immediately invalidate all persistent authentication cookies and database credentials:

1. Change MySQL Database Password: Update in both cPanel/phpMyAdmin and wp-config.php.
2. Rotate WordPress Secret Keys & Salts: Generate fresh salts from api.wordpress.org/secret-key/1.1/salt/ and paste them into wp-config.php.
3. Change All cPanel, FTP, and SSH Passwords.

---

5. Hour 19–24: WAF Hardening & Google Search Console Remediation

Once the site is verified clean:

1. Lift maintenance mode.
2. Log into Google Search Console:
   • Go to Security Issues and request a review.
   • Go to Removals and submit temporary removal requests for indexed /slot-* or /judi-* spam URLs.
3. Deploy Cloudflare WAF Rules to block known bad bot signatures, XML-RPC brute force attacks, and high-risk foreign proxy networks.

---

Emergency Hack Recovery Services by JagaWeb

Dealing with an active website intrusion while losing customers is overwhelming.

JagaWeb provides 24-hour emergency hack remediation and managed security for Malaysian businesses.

• RM5,000 Emergency Recovery & Forensic Audit: Complete malware purge, backdoor removal, database sanitization, Google blacklist removal, and root cause patch.
• RM450/month Managed Care Plan: Continuous malware scanning, daily encrypted offsite backups, firewall management, and real-time security alerts.

Request Emergency Hack Cleanup Assistance.