The htaccess file is used to rewrite the URLs. In the case of compromised web sites, the .htaccess file is frequently changed so that visitors to compromised web sites are redirected to other websites (usually adult or web sites that try to install malware).
A quick check of your website can be done by visiting http://google.com/safebrowsing/diagnostic?site=example.tld (replace example.tld with your domain name)
How do you check the .htaccess file for potential security issues?
- Authenticate in cPanel
- Go to File Manager and in the upper right corner, click Settings; Check the Show Hidden Files option and click Save
- Right-click the .htaccess file and select Edit
- Check the file and try to identify if there are suspicious code lines
If you identify code lines like the one below, your site is most likely compromised. Make a copy of the .htaccess file and then delete the suspicious lines.
RewriteRule .* http://domeniuMalitios.tld/bad.php?t=3 [R,L]Atention!!
Deleting suspicious lines in .htaccess does not guarantee to solve the problem you have with your website; it's just one of the steps to follow when cleaning your website.
