# Site being hacked - injection into tracking code snippet
**URL:** https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883
**Category:** Using Concrete / Help
**Created:** [March 17, 2025, 6:44pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883 "2025-03-17T18:44:55Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@plschneide](https://forums.concretecms.org/u/plschneide)
#### Post date: [March 17, 2025, 6:44pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/1 "2025-03-17T18:44:55Z")
One of my sites (on the latest release) keeps getting hacked and they are injecting code into the “tracking” area where we have our google tracking code.
E.g., injecting in with the google code.
---
### Author:  [@mesuva](https://forums.concretecms.org/u/mesuva)
#### Post date: [March 17, 2025, 6:58pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/2 "2025-03-17T18:58:39Z")
Are you sure it’s not just Google tag manager inserting extra scripts?
If you actually view the HTML of the page directly, can you see these scripts?
A URL would help here.
---
### Author:  [@Cahueya](https://forums.concretecms.org/u/Cahueya)
#### Post date: [March 17, 2025, 6:59pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/3 "2025-03-17T18:59:42Z")
I havent heard of it before, but it seems to be a known issue:
> **[Hackers Using Google Analytics to Bypass Web Security and Steal Credit Cards](https://thehackernews.com/2020/06/google-analytics-hacking.html)**
>
> Hackers Using Google Analytics Tracking Code to Bypass Website Security and Steal Credit Cards
---
### Author:  [@plschneide](https://forums.concretecms.org/u/plschneide)
#### Post date: [March 18, 2025, 12:21am UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/4 "2025-03-18T00:21:41Z")
Yes so you could see in the tracking code
A week earlier there was something similar added in
---
### Author:  [@plschneide](https://forums.concretecms.org/u/plschneide)
#### Post date: [March 18, 2025, 12:51am UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/5 "2025-03-18T00:51:43Z")
Related question - I was trying to find where the tracking code was stored in the CMS system. Looks like it is in application/config/generated\_overrides/site.php - is that correct or am I missing something?
---
### Author:  [@webpresso](https://forums.concretecms.org/u/webpresso)
#### Post date: [March 18, 2025, 1:38pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/6 "2025-03-18T13:38:41Z")
Yes this is right. Thats the place where this is stored.
---
### Author:  [@Cahueya](https://forums.concretecms.org/u/Cahueya)
#### Post date: [March 19, 2025, 5:40am UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/7 "2025-03-19T05:40:44Z")
I think adjusting the Content Security Policy in the server configuration will stop that issue.
Like so:
```auto
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-scripts.com";
```
---
### Author:  [@Cahueya](https://forums.concretecms.org/u/Cahueya)
#### Post date: [March 19, 2025, 5:42am UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/8 "2025-03-19T05:42:42Z")
This will only allow loading javascript from [https://trusted-scripts.com](https://trusted-scripts.com) and nowhere else. Adjust it to your needs, your site might load ressources from other domains as well.
---
### Author:  [@plschneide](https://forums.concretecms.org/u/plschneide)
#### Post date: [March 23, 2025, 8:05pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/9 "2025-03-23T20:05:56Z")
BTW god idea - did some tests and there are at least a few things I would need to do to change the site to allow that to work (many items being blocked that are legit at the moment). As a temp workaround, I wrote a script that looks to the site and if the google script changes from what it should be, it notifies me and then rewrites it to what it should be.
---
### Author:  [@JohntheFish](https://forums.concretecms.org/u/JohntheFish)
#### Post date: [March 24, 2025, 2:34pm UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/10 "2025-03-24T14:34:43Z")
This all seems a bit elastoplast. Patching over the symptoms rather than resolving the original cause.
Whilst such measures are valid, they are secondary measures. You need to find out how the site tracking codes are being repeatedly hijacked (from a server account, from a site admin account, from some dodgy php added to the site, from a cheap hosts advertising dept, … ) and lock that down. If in any doubt, change all hosting and admin passwords now.
---
### Author:  [@plschneide](https://forums.concretecms.org/u/plschneide)
#### Post date: [March 25, 2025, 12:26am UTC](https://forums.concretecms.org/t/site-being-hacked-injection-into-tracking-code-snippet/8883/11 "2025-03-25T00:26:24Z")
Yup no disagreement there and did change all the passwords to be sure combed logs - nothing has come up as a clear root cause and it hasn’t happened again in a couple weeks - but of course that doesn’t mean anything. Next steps will be upgrading server (current setup was reaching eol - this just speeds it up)