On my site there is a script after the body tag, both on frontend and adminhtml. I can't find where it is included:

this script

It adds links in the header. Has anyone seen this?

3 Answers 3


What this is:

  • a black hat SEO technique: these links are moved out of the visible area using JavaScript, to trick search engines

What it is not:

  • a virus

What it can be, given you did not add the code yourself:

  • the result of a hack
  • something, a malicious extension or theme developer added

If you did not find the code in your files and database, it's probably obfuscated. Search for "base64_decode" and "eval" in your code base and you probably find the source.

If it is from an extension or theme, compare the code with the originally downloaded files to see if it has been added by the developers or by a hacker afterwards.

If the code is already in the original files, you are lucky under the circumstances: your server has not been compromised. But you should remove the extension/theme because it cannot be trusted.

Otherwise, please refer to What should you do with the hacked installation?


You should compare URL addresses with your website address or partners’ site address. If they don't lead to your website or any known partners’ site, this is clearly an unfair way to increase pages’ rank. Maybe one of your developers added them. In any case, if you are not using them, the best solution would be to remove them. Such a promotion can negatively influence your website rank and is unlikely bring any benefits.


I would start by thinking if I recognize those domains and what those Cyrillic characters means :).

If they don't look familiar to you. Check your explorer, maybe is just an extension injecting "cool" stuff on the page.Of course check your code base also roughly.

And to answer your question, No, I haven't seen it before.

  • Cyrillic characters are advertising clothing I've tried to find it in the database and files. But not found
    – omelandr
    Apr 8, 2016 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.