Renamed admin folder being indexed

Hi all

I have just upgraded from 1.3.8a to 1.5.0 after being hacked, yeah I know, I should have upgraded a long time ago and have now paid the price (PayPal/credit card hack). I am now going to upgrade immediately when a new version is released and advise everyone else to do the same :smile:.

The upgrade to 1.5.0 went well and my site is up and running again with no issues. I followed all instructions for recovering from hacks.

I have since found that my previously renamed admin login page for 1.3.8a had been indexed and can be found on two major search engines. The error log shows numerous attempts to access my site using this old admin name.

Was the admin login page indexed due to a problem with the 1.3.8a version or maybe due to an addon I have installed?

Although I have a new admin folder name, I am worried the admin login page for the 1.5.0 version will be indexed again, which I obviously want to avoid.

The robot.txt did not contain any admin details.

Thanks!

inky100:

I am now going to upgrade immediately when a new version is released and advise everyone else to do the same :smile:.

Personally I tend to wait a few weeks or so before doing any upgrades (well, at least with our live store). Security fixes excepted.

inky100:

I have since found that my previously renamed admin login page for 1.3.8a had been indexed

This should never happen, UNLESS you (or someone else) had made a publically accessible link to it).

inky100:

and can be found on two major search engines. The error log shows numerous attempts to access my site using this old admin name.

It isn't possible to un-index a page/site, and as long as the old admin name doesn't exist the attempts are harmless anyway.

However, if it bothers you then performing a redirect to a different page when the attempts are made is a possible solution.
Another solution is to leave the old renamed folder in place and populate it with a simple index.html page saying "Sorry hacker, you can't get in this way any longer" will perhaps prevent them from further attempts..
Usually a simple page-not-found is enough though.

inky100:

Was the admin login page indexed due to a problem with the 1.3.8a version or maybe due to an addon I have installed?

If it was renamed and still indexed, then it is probably due to an addon.

There should never ever be any publically accessible links to any of the /admin/ pages.

inky100:

Although I have a new admin folder name, I am worried the admin login page for the 1.5.0 version will be indexed again, which I obviously want to avoid.

There are tools/programs available that will allow you to crawl/index your own site - Any of these should reveal if this foldername is being leaked by your own store.

inky100:

The robot.txt did not contain any admin details.
Thanks!

Good. Keep it that way.
It is a common rookie mistake to add the admin folder name into this file to prevent indexing, but all it really does is provide the name of the folder to the 'bad guys', which defeats the purpose.

Anyway, as I stated, if there are no links to your admin folder then the search engines will not be able to find it (which is exactly what you want). It IS possible for a hacker to guess the name you use (and if succesfull they have no qualms about publicising it among there peers, and eventually it'll find its way into a search engine), but the search engines themselves make no such 'guesses'.

Hope this helps
Cheers
Rod

Hi Rod

Thanks for the helpful info.

I have found 'Xenu's Link Sleuth', would this be ok to use to crawl my site to find any problems?

Thanks

If you have a google webmaster account, you can login and remove pages from your site from the index

http://support.google.com/webmasters/bin/answer.py?hl=en&answer=164734

I don't know if bing and yahoo have similar tools

Login page was indexed by Yahoo and Bing, but not Google, for some reason?

inky100:

Login page was indexed by Yahoo and Bing, but not Google, for some reason?

Do you have webmaster accounts with those 2 providers, I know with google you can download backlinks and see what links to your site

And as Rod said I always wait a period before upgrading to the new version, so any kinks are found.

Hi Nigel

Thanks for the advice.

I couldn't find any suspicious backlinks, but using Bing Webmaster, I have found the indexed admin login page link.

It shows it was discovered 4 months ago and last crawled two weeks ago. My site was hacked last week.

I have selected the 'Block URL and Cache' for this link, but still a bit worried not having found the reason for the admin login page to be indexed.

Not sure if it helps, but when entering the search term 'mysite'/admin using Bing or Yahoo, it returns the crawled login page for 'mysite'/renamed admin folder.

Thanks

I know this is an old post but I think I know how my admin directory got indexed so I thought I would share.

I added a link to my admin to my favorites and was using Xmarks to sync favorites to different machines. I should have known better, but sometimes you get sloppy. My guess is xmarks is sharing with google, but it may be possible I put the link somewhere else where google could get it.

These days with all the free apps (desktop and phone), you have to be careful since many of them harvest info from anything used within them (links in emails, favorites, etc).

Anyway, I'm changing my admin folder and not putting a link to it in anything accessed by a 3rd party utility. I'll give it some time and see if it gets found.

In looking further into how google could have gotten my admin folder location, it could be numerous ways in addition to favorites syncing. When using the "predict" settings in chrome browser, my guess is every site entered in the address bar goes through google (may happen even if you don't use the predict settings). In addition, anything accessed through my android phone probably goes through google (and everyone else who's apps I use).

I'm beginning to think the days of "hiding" the admin folder by renaming it are coming to a close unless you only access it through a browser with very high privacy settings and no additional services turned on.

Without a login password, they can't access anything other than your login page.

And, ZC v1.3.9 and newer all contain the "noindex,nofollow" metatag on the admin login page, which tells them to skip it if they do come to it:```
<meta name="robot" content="noindex, nofollow" />