title: Hidden redirect in hacked site?
body: <p>One of our Wordpress websites running on an Apache server was recently hacked via PHP injection.</p>
  
  <p>The hackers installed hundreds of URLs that redirected to an external eCommerce that sold watches; the URLs were of the form <code>http://www.example.com/eta.php?some_file.html</code>; for example: <code>http://www.example.com/eta.php?Jewellery-Watches-Others-c138-4.html</code>.</p>
  
  <p>We think we have deleted all infected PHP code. However, the hacked URLs, rather than returning 404, now do a 301 redirect to <code>http://www.example.com/?some_file.html</code> (that is, the same URL without the <code>eta.php</code> part), and finally show the website homepage, returning code 200. Please note that my <code>.htaccess</code> file seems to be perfectly clean.</p>
  
  <p><strong>Where is this phantom redirect coming from?</strong></p>
  
  <p>I would be very grateful to anybody that could help me understand what's going on. I am worried that we did not completely wiped out the hack.</p>
  
  <p>Thank you for your attention!</p>
  
  <p><strong>FURTHER DETAILS</strong></p>
  
  <p>The file <code>eta.php</code> is nowhere to be found on the server. Replacing <code>eta.php</code> with a random file (ex. <code>ate.php</code>) in the hacked URLs yields a 404 code as expected.</p>
  
  <p>In the end I managed to force the hacked URLs to return 404 using the following .htaccess rule:</p>
  
  <pre><code>RewriteCond %{THE_REQUEST} /eta\.php
  RewriteRule ^(.*)$ - [R=404,L,NC]
  </code></pre>
  
  <p>Interestingly enough, this other rule did not work, as if the hack was somehow messing up with <code>%{REQUEST_URI}</code>:</p>
  
  <pre><code>RewriteCond %{REQUEST_URI} ^/eta\.php [NC]
  RewriteRule (.*) - [R=404,L]
  </code></pre>