Hidden Link Injection

Injection needs write access somewhere in the rendering path. In practice that means a vulnerable plugin, a compromised administrator account, a writable theme directory, or a stored cross-site scripting flaw that lets untrusted input reach a template. Once inside, the attacker appends markup to whatever renders on every page — most often a footer include, a widget, or a header hook.

1. STEP 01

   Count outbound domains

   Extract every external link from your key templates and compare against the domains you intentionally link to. Anything unexplained is a candidate.

2. STEP 02

   Diff rendered text against source

   Anchor text that exists in the HTML but never appears on screen is the definition of a hidden link.

3. STEP 03

   Check computed styles

   Inspect anchors for zero dimensions, hidden visibility, transparent colour, or extreme offsets.

4. STEP 04

   Search stored content

   Query post bodies, options tables and cached fragments for the offending domains and for suspicious inline style attributes.

1. Record every injected URL and its location before deleting anything.
2. Remove the markup from templates, then reinstall the affected theme or plugin from source to catch what you missed.
3. Clean stored content in the database, including revisions and cached fragments.
4. Purge every caching layer, including any CDN.
5. Rotate administrator and hosting credentials and review user accounts.
6. Re-scan after 24 hours; a reappearance means an active backdoor remains.

• Deny write access to theme and plugin directories in production.
• Track file integrity so template changes generate an alert.
• Add a Content Security Policy to limit what injected markup can load.
• Review installed plugins quarterly and remove anything unmaintained.