One of my sites (on the latest release) keeps getting hacked and they are injecting code into the “tracking” area where we have our google tracking code.
E.g., injecting in with the google code.
Are you sure it’s not just Google tag manager inserting extra scripts?
If you actually view the HTML of the page directly, can you see these scripts?
A URL would help here.
1 Like
I havent heard of it before, but it seems to be a known issue:
1 Like
Yes so you could see in the tracking code
A week earlier there was something similar added in
Related question - I was trying to find where the tracking code was stored in the CMS system. Looks like it is in application/config/generated_overrides/site.php - is that correct or am I missing something?
Yes this is right. Thats the place where this is stored.
I think adjusting the Content Security Policy in the server configuration will stop that issue.
Like so:
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-scripts.com";
1 Like
This will only allow loading javascript from https://trusted-scripts.com and nowhere else. Adjust it to your needs, your site might load ressources from other domains as well.
1 Like
BTW god idea - did some tests and there are at least a few things I would need to do to change the site to allow that to work (many items being blocked that are legit at the moment). As a temp workaround, I wrote a script that looks to the site and if the google script changes from what it should be, it notifies me and then rewrites it to what it should be.
This all seems a bit elastoplast. Patching over the symptoms rather than resolving the original cause.
Whilst such measures are valid, they are secondary measures. You need to find out how the site tracking codes are being repeatedly hijacked (from a server account, from a site admin account, from some dodgy php added to the site, from a cheap hosts advertising dept, … ) and lock that down. If in any doubt, change all hosting and admin passwords now.
2 Likes
Yup no disagreement there and did change all the passwords to be sure combed logs - nothing has come up as a clear root cause and it hasn’t happened again in a couple weeks - but of course that doesn’t mean anything. Next steps will be upgrading server (current setup was reaching eol - this just speeds it up)
1 Like