Hello,
I kindly request your assistance in resolving an issue that has occurred with my journal website hosted on the OJS platform. During the summer, suspicious users began registering on the site —non-authentic “bots” who submitted materials containing unknown and potentially harmful file formats, and whose names consisted of random characters. I removed these submissions and files, but later another issue appeared: the site’s pages started loading very slowly. When I checked the HTML code of the main page, I found external links to unknown websites. These links appeared to have been inserted into the index.php file. After removing them, the site returned to normal operation.
Later, I registered the site in Google Search Console to monitor its indexing and traffic. There, I noticed incoming visits triggered by the search term “starlinkbet88”, mostly from Indonesia. I downloaded all site files from the hosting server to my computer and searched for this term, but it was not found anywhere in the site’s files. After reviewing incomplete submissions again, I discovered several suspicious files and deleted them. After some time, such unnatural traffic to the site stopped.
During the initial verification of the website in Google Search Console, I uploaded the verification file to the root directory to confirm ownership. However, recently, new owners whom I do not know occasionally appear in the console. I remove them, but one cannot be removed completely because it is verified through a meta tag: < meta name="google-site-verification" content="ExxbjAR4hIPbiiDUrD29_Xp_uwRnKSoqsV0Dm1igMIQ" / >
Google Search Console indicates that this tag was added to the main page and that the owner with the username tadelia975 was verified through it. However, I cannot locate this tag in any of the site files — full text search produces no results.
Could you please advise where exactly within the OJS file structure such a meta tag could be located? Which template or PHP files typically contain the tag? Is it possible that it was added via a plugin, a modification in the database, or another source? I would also appreciate recommendations on what steps to take to thoroughly check the website for unauthorized changes. I suspect that the site might have undergone unwanted interference and would be grateful for your help in diagnosing and resolving the issue.
Sincerely, Artem