Problem adding Google Analytics Code and Facebook pixel in Magento Community 1.9.3 [closed]

Question

Our site was hacked a while back and ever since we 'brought it back' we are unable to add Google Analytics code or a new Facebook pixel in - System/Configuration/General/Design/HTML Head/Miscellaneous Scripts. I've also tried manually pasting both codes into all the instances of head.phtml I was able to find.

Answer 1

I imagine you have some understanding as to what was the hack you had in your site? If yes, I'd say do make sure any trace of this hack is removed from your site as otherwise your are liable to leave your site harmful for yourself and the customers using the site

It is common that hacks are malicious snippets stored in your miscellaneous config (the one you mention in your post).

--> since you mention you can't use this input, my advice is to clear it from the database rather than from the backend. Even if it appears empty, these hacks are sneaky enough to come up with a way to be hidden enough for you to think there is nothing there..

go in the database and run the mysql command below ( you may replace <prefix> in the queries below if relevant to your site: see app/etc/config.xml, if your site does not use prefix, then leave this <prefix> empty)

select * from <prefix>core_config_data where path='design/head/includes';

you may see some scripts at this point that you were not aware of in fact.

copy safely the content of this row for your reference should something happen and you would want to revert later.

and then run:

delete from <prefix>core_config_data where path='design/head/includes';

It is likely after this you will be fine with saving your config in the backend. If not and if you have seen some malicious scripts thanks to this process, you may google the name of the scripts and you will find likely many solutions to thoroughly sanitise the site.

• finally, if the hack was in your backend, it is clear that somebody has suceeded to login in your backend or worse has logged in into your database.
• It is highly recommended to change your admin user password.
• change the admin url to something cryptic 55uuehhe_admin for instance
• if you have access to server config, you could restrict the admin access to your IP (that is possibly more advanced but of course will give deterrent to malicious users to come in)