{"id":103,"date":"2026-01-13T00:00:00","date_gmt":"2026-01-12T23:00:00","guid":{"rendered":"https:\/\/helloblog.io\/sl\/wordpress-cloaking-googlebot-ip-preverjanje\/"},"modified":"2026-01-20T06:33:06","modified_gmt":"2026-01-20T05:33:06","slug":"wordpress-cloaking-googlebot-ip-preverjanje","status":"publish","type":"post","link":"https:\/\/helloblog.io\/sl\/wordpress-cloaking-googlebot-ip-preverjanje\/","title":{"rendered":"Ko Google vidi nekaj drugega kot ti: napreden WordPress cloaking z IP-preverjanjem Googlebota"},"content":{"rendered":"\n<p>V WordPress svetu smo \u017ee vajeni zlorab tipa <em>SEO spam<\/em>, preusmeritev in klasi\u010dnega &#8220;cloakinga&#8221; (prikaz razli\u010dne vsebine botom in ljudem). Zanimiv (in precej nevaren) zasuk pa je, ko napadalec ne ra\u010duna ve\u010d na grobo filtriranje po <code>User-Agent<\/code>, ampak posku\u0161a z visoko natan\u010dnostjo preveriti, ali je obiskovalec res del Googlove infrastrukture. Rezultat: lastnik spletne strani pri ro\u010dnem preverjanju ne vidi ni\u010desar sumljivega, Google pa indeksira \u010disto drugo vsebino.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kaj je bilo kompromitirano: index.php kot \u201cvratar\u201d<\/h2>\n\n\n\n<p>V analiziranem primeru je bila zlonamerna logika vstavljena neposredno v glavni <code>index.php<\/code> WordPress strani. To je strate\u0161ka to\u010dka: <code>index.php<\/code> je vstopna datoteka, prek katere WordPress v obi\u010dajnem primeru nalo\u017ei okolje (bootstrap) in nato izri\u0161e stran. \u010ce napadalec prevzame nadzor tukaj, lahko pred normalnim nalaganjem WordPressa odlo\u010di, ali bo obiskovalec videl legitimno stran ali pa bo dobil vbrizgano oddaljeno vsebino.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Zakaj je ta cloaking druga\u010den od ve\u010dine<\/h2>\n\n\n\n<p>Klasi\u010dni cloaking se pogosto zana\u0161a na preprost <code>User-Agent<\/code> filter: \u010de niz vsebuje &#8220;Googlebot&#8221;, bot dobi spam vsebino. Te\u017eava za napadalca je, da je <code>User-Agent<\/code> trivialno ponarediti, zato tak\u0161ne kampanje relativno hitro odkrijemo z ro\u010dnim testiranjem ali z osnovnimi skenerji.<\/p>\n\n\n\n<p>Tukaj pa je bila uporabljena bolj &#8220;in\u017eenirska&#8221; varovalka: skripta je imela hardkodiran nabor Googlovih ASN (Autonomous System Number) IP-rangeov v CIDR zapisu in je obiskoval\u010dev IP preverjala matemati\u010dno, z bitnimi (bitwise) operacijami. Poleg IPv4 je imela tudi solidno podporo za IPv6, kar je pri starej\u0161ih cloaking skriptah pogosto spregledano.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1360\" height=\"636\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic.png\" alt=\"Diagram IP-preverjene pogojne logike za prikaz razli\u010dne vsebine Googlebotu in uporabnikom\" class=\"wp-image-95\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic.png 1360w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic-1024x479.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic-768x359.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/IP-Verified-Conditional-Logic-400x187.png 400w\" sizes=\"auto, (max-width: 1360px) 100vw, 1360px\" \/><figcaption class=\"wp-element-caption\">Napad je zasnovan tako, da se zlonamerna vsebina prika\u017ee le, \u010de je obiskovalec potrjen kot Google infrastruktura. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Hitri pojmi: ASN in CIDR (v kontekstu napada)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">ASN (Autonomous System Number)<\/h3>\n\n\n\n<p>ASN si lahko predstavlja\u0161 kot identiteto omre\u017eja na internetu: \u0161tevilka, ki predstavlja ve\u010dji blok IP naslovov in usmerjevalno politiko organizacije (npr. Google). \u010ce promet prihaja iz IP prostora, ki pripada Googlovim ASN-jem, je bistveno bolj verjetno, da gre za \u201cpravi\u201d Googlebot (oziroma Googlov crawler iz njihove infrastrukture), ne samo za ponarejen <code>User-Agent<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CIDR zapis<\/h3>\n\n\n\n<p>CIDR (Classless Inter-Domain Routing) je kratek zapis IP obsegov, npr. <code>192.168.1.0\/24<\/code>, ki opi\u0161e blok naslovov z omre\u017enim prefiksom. Namesto na\u0161tevanja vsakega IP-ja posebej lahko z enim zapisom definira\u0161 celoten range.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>192.168.1.0\/24\n# pomeni IP-je od 192.168.1.0 do 192.168.1.255\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span>192.168.1.0\/24<\/span><\/span>\n<span class=\"line\"><span># pomeni IP-je od 192.168.1.0 do 192.168.1.255<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1332\" height=\"620\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format.png\" alt=\"Ilustracija CIDR zapisa in pripadajo\u010dega IP obsega\" class=\"wp-image-96\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format.png 1332w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format-300x140.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format-1024x477.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format-768x357.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/CIDR-format-400x186.png 400w\" sizes=\"auto, (max-width: 1332px) 100vw, 1332px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Kako napad deluje v praksi (po fazah)<\/h2>\n\n\n\n<p>Vstavljena koda deluje kot selektivni proxy: najprej ugotovi identiteto obiskovalca, nato se odlo\u010di, ali bo WordPress normalno nadaljeval ali pa bo stran nalo\u017eila vsebino iz oddaljenega vira in jo prikazala kot da je lokalna.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Ve\u010dplastna identifikacija: User-Agent + IP preverjanje<\/h3>\n\n\n\n<p>Najprej se skripta loti &#8220;hitrega&#8221; filtra prek <code>HTTP_USER_AGENT<\/code> (User-Agent je identifikacijski niz, ki ga brskalnik ali bot po\u0161lje ob vsaki zahtevi). Ker je to mogo\u010de ponarediti, sledi drugi korak: preverjanje, ali IP res spada v Googlov ASN range.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"498\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification.png\" alt=\"Shema ve\u010dplastnega preverjanja identitete obiskovalca (User-Agent in IP range)\" class=\"wp-image-97\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification.png 1880w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification-300x79.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification-1024x271.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification-768x203.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification-1536x407.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Multi-Layer-Identity-Verification-400x106.png 400w\" sizes=\"auto, (max-width: 1880px) 100vw, 1880px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">2) Validacija IP-rangea z bitnimi operacijami<\/h3>\n\n\n\n<p>Namesto preprostega primerjanja nizov skripta pretvori IP in omre\u017eje v numeri\u010dno obliko in z netmasko preveri ujemanje z omre\u017enim blokom. Bistvo je v logiki: &#8220;ali IP po maskiranju pade v isti network kot definiran range&#8221;.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Konceptualni izsek iz opisa tehnike: preverjanje ujemanja z omre\u017ejem\n($ip_decimal &amp; $netmask_decimal) == ($range_decimal &amp; $netmask_decimal);\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Konceptualni izsek iz opisa tehnike: preverjanje ujemanja z omre\u017ejem<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">($ip_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal) <\/span><span style=\"color:#F97583\">==<\/span><span style=\"color:#E1E4E8\"> ($range_decimal <\/span><span style=\"color:#F97583\">&#x26;<\/span><span style=\"color:#E1E4E8\"> $netmask_decimal);<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1420\" height=\"734\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation.png\" alt=\"Prikaz bitnega (bitwise) preverjanja, ali IP spada v dolo\u010den CIDR range\" class=\"wp-image-98\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation.png 1420w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation-300x155.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation-1024x529.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation-768x397.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Bitwise-IP-Range-Validation-400x207.png 400w\" sizes=\"auto, (max-width: 1420px) 100vw, 1420px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">3) Oddaljen payload prek cURL (remote content injection)<\/h3>\n\n\n\n<p>Ko je obiskovalec potrjen kot legitimen Google crawler, koda prek cURL potegne vsebino z zunanje lokacije in jo izpi\u0161e v response. V opisanem primeru je bil uporabljen domena\/host: <code>hxxps:\/\/amp-samaresmanor[.]pages[.]dev<\/code> (zapis z oklepaji je namenjen varnemu navajanju zlonamernih domen).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1444\" height=\"836\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL.png\" alt=\"Shema nalaganja oddaljene vsebine prek cURL in izpisa v response\" class=\"wp-image-99\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL.png 1444w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL-300x174.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL-1024x593.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL-768x445.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Remote-Payload-Execution-via-cURL-400x232.png 400w\" sizes=\"auto, (max-width: 1444px) 100vw, 1444px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">4) \u0160irok nabor User-Agent nizov (ne samo \u201cGooglebot\u201d)<\/h3>\n\n\n\n<p>Napadalec ni ciljal le na osnovni &#8220;Googlebot&#8221; podpis. Skripta je filtrirala tudi nize, povezane z Google orodji za verifikacijo, inspeksijo in razli\u010dnimi crawlerji\/API klienti. S tem pove\u010da verjetnost, da bo spam vsebina ne samo indeksirana, ampak tudi uspe\u0161no prestala razli\u010dne Google procese preverjanja.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1682\" height=\"554\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering.png\" alt=\"Primer filtriranja User-Agent nizov za Google bot ekosistem\" class=\"wp-image-100\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering.png 1682w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering-300x99.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering-1024x337.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering-768x253.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering-1536x506.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/User-Agent-Filtering-400x132.png 400w\" sizes=\"auto, (max-width: 1682px) 100vw, 1682px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">5) Pogojna logika + logging: skrito, a nadzorovano<\/h3>\n\n\n\n<p>Najbolj zlove\u0161\u010de je, da napadalec o\u010ditno skrbi za &#8220;kakovost&#8221; napada: v primeru napake pri nalaganju oddaljene vsebine bot preusmeri (npr. na <code>\/home\/<\/code>), da Google ne vidi pokvarjene strani. \u010ce nekdo ponareja Googlebot <code>User-Agent<\/code>, a IP ne ustreza, skripta zabele\u017ei dogodek (&#8220;Fake GoogleBot&#8221;) in uporabnika preusmeri na legitimno doma\u010do stran. Obi\u010dajni obiskovalci so praviloma takoj preusmerjeni na normalno vsebino, zato lastnik pogosto ni\u010desar ne opazi.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1694\" height=\"680\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging.png\" alt=\"Diagram odlo\u010danja: legitimen bot dobi zlonamerno vsebino, la\u017eni bot in uporabnik dobita legitimno stran\" class=\"wp-image-101\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging.png 1694w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging-300x120.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging-1024x411.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging-768x308.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging-1536x617.png 1536w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/Conditional-Logic-and-Error-Logging-400x161.png 400w\" sizes=\"auto, (max-width: 1694px) 100vw, 1694px\" \/><figcaption class=\"wp-element-caption\"><em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Vloga WordPress core datotek: wp-load.php in wp-blog-header.php<\/h2>\n\n\n\n<p>Da stran za ljudi deluje normalno, napadalec pogosto pusti, da se WordPress vseeno &#8220;bootstrapa&#8221;. V opisanem primeru je zlonamerna koda klicala <code>wp-load.php<\/code> (ta nalo\u017ei konfiguracijo in pripravi WordPress okolje, vklju\u010dno z dostopom do baze). V obi\u010dajnem toku <code>index.php<\/code> na koncu nalo\u017ei \u0161e <code>wp-blog-header.php<\/code>, ki izvede glavni WordPress request lifecycle. Vse to napadalcu omogo\u010da, da zlonamerno logiko elegantno vklju\u010di, brez da bi takoj podrl spletno mesto.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ Tipi\u010den bootstrap v WordPress kontekstu\nrequire_once __DIR__ . '\/wp-load.php';\n\/\/ ... in v standardnem index.php \u0161e wp-blog-header.php (odvisno od implementacije)\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ Tipi\u010den bootstrap v WordPress kontekstu<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">require_once<\/span><span style=\"color:#79B8FF\"> __DIR__<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#9ECBFF\"> '\/wp-load.php'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">\/\/ ... in v standardnem index.php \u0161e wp-blog-header.php (odvisno od implementacije)<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Posledice: predvsem SEO in reputacija domene<\/h2>\n\n\n\n<p>Ta tip oku\u017ebe je bolj &#8220;tiha&#8221; kot klasi\u010dni deface ali masovni redirect. Glavni udarec je na SEO in zaupanje v domeno: Google indeksira vsebino, ki je ti ne vidi\u0161, kar lahko vodi v odstranjevanje iz indeksa (deindexing), blacklisting, degradacijo rezultatov in dolgotrajne te\u017eave z reputacijo. Ker je payload oddaljen, lahko napadalec vsebino menja brez dodatnih sprememb na tvojem stre\u017eniku.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1270\" height=\"936\" src=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees.png\" alt=\"Primer: Google vidi spam vsebino, uporabniki pa \u0161e vedno originalno spletno stran\" class=\"wp-image-102\" srcset=\"https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees.png 1270w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees-300x221.png 300w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees-1024x755.png 1024w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees-768x566.png 768w, https:\/\/helloblog.io\/app\/uploads\/sites\/17\/2026\/01\/What-Google-sees-400x295.png 400w\" sizes=\"auto, (max-width: 1270px) 100vw, 1270px\" \/><figcaption class=\"wp-element-caption\">Tipi\u010den simptom cloakinga: SERP in cache\/preview ka\u017eeta nekaj drugega kot ro\u010dni obisk. \u2014 <em>Forr\u00e1s: Sucuri Blog<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Znaki, da ima\u0161 podoben problem<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>V Google rezultatih (SERP) se pojavljajo \u010dudni naslovi\/odlomki, ki nimajo veze s tvojo vsebino.<\/li>\n\n\n<li>Nepri\u010dakovane ali nedavne spremembe v core datotekah (\u0161e posebej <code>index.php<\/code>).<\/li>\n\n\n<li>Sumljivi URL-ji ali strani, ki obstajajo v indeksu, na strani pa jih ne najde\u0161.<\/li>\n\n\n<li>Nenavadni log zapisi (preusmeritve, cURL klici, dostopi do index.php) ali spremembe \u010dasov zadnje modifikacije datotek.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Pomembno<\/h4>\n\n\n<p>Ker napad cilja predvsem crawlerje, ga z obi\u010dajnim brskanjem pogosto ne bo\u0161 reproduciral. Pri diagnostiki ima veliko te\u017eo pregled indeksiranih URL-jev in podatkov v Google Search Console.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Kaj narediti ob sanaciji (remediation)<\/h2>\n\n\n\n<p>Pri takem incidentu ima\u0161 praviloma dve nalogi: odstraniti zlonamerno logiko in zapreti vstopno to\u010dko, da se kompromis ne ponovi. Sucuri v priporo\u010dilih izpostavlja klasi\u010dne korake, ki v praksi \u0161e vedno najve\u010dkrat re\u0161ijo situacijo.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Odstrani neznane datoteke in direktorije: vse, \u010desar nisi namestil ti ali tvoj razvijalec (posebej v rootu in v <code>wp-includes<\/code>\/<code>wp-admin<\/code>\/mu-plugins).<\/li>\n\n\n<li>Preveri uporabnike: odstrani sumljive administratorje in &#8220;pomo\u017ene&#8221; ra\u010dune, ki niso dokumentirani.<\/li>\n\n\n<li>Resetiraj poverilnice: WordPress admin, FTP\/SFTP, hosting panel, baze (DB) in po potrebi SSH klju\u010de.<\/li>\n\n\n<li>Skeniraj lokalni ra\u010dunalnik: \u010de je kompromitiran tvoj dev stroj, se bodo poverilnice hitro spet zlorabile.<\/li>\n\n\n<li>Posodobi vse: WordPress core, teme in vti\u010dnike; odstrani neuporabljene komponente.<\/li>\n\n\n<li>Uporabi WAF (Web Application Firewall): WAF lahko blokira znane zlonamerne zahteve in komunikacijo s C2\/payload stre\u017eniki ter ote\u017ei za\u010detni upload zlonamernega koda.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Preventiva, ki se pri core-file napadih najbolj obnese<\/h2>\n\n\n\n<p>Ker je bil napad v core vstopni to\u010dki (<code>index.php<\/code>), je zelo smiselno imeti mehanizem, ki tak\u0161ne spremembe hitro zazna. V praksi so najbolj uporabne naslednje navade:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>File Integrity Monitoring (FIM): spremljanje sprememb kriti\u010dnih datotek (npr. <code>index.php<\/code>, <code>wp-config.php<\/code>).<\/li>\n\n\n<li>Reden pregled Google Search Console: nenadni &#8220;Coverage&#8221; problemi, \u010dudni URL-ji ali ro\u010dni ukrepi so pogosto prvi signal.<\/li>\n\n\n<li>Minimalen napadalni povr\u0161inski sloj: manj vti\u010dnikov, odstranitev opu\u0161\u010denih\/neudr\u017eevanih komponent, stro\u017eji access control.<\/li>\n\n\n<li>Logiranje in alerting na nivoju hostinga\/WAF: posebno za nenavadne requeste na root <code>index.php<\/code> in outbound HTTP klice iz PHP-ja.<\/li>\n\n<\/ul>\n\n\n<div class=\"references-section\">\n                <h2>Reference \/ Viri<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/malware-intercepts-googlebot-via-ip-verified-conditional-logic.html\" target=\"_blank\" rel=\"noopener noreferrer\">Malware Intercepts Googlebot via IP-Verified Conditional Logic<\/a><\/li><li><a href=\"https:\/\/blog.sucuri.net\/2026\/01\/google-sees-spam-you-see-your-site-a-cloaked-seo-spam-attack.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google Sees Spam, You See Your Site: A Cloaked SEO Spam Attack<\/a><\/li><li><a href=\"https:\/\/www.virustotal.com\/gui\/url\/5a006beedf563c6215a31746d011d13fd4f2561a1bf3b557484c4532b13e1ec6?nocache=1\" target=\"_blank\" rel=\"noopener noreferrer\">VirusTotal URL report<\/a><\/li><li><a href=\"https:\/\/publicwww.com\/websites\/amp-samaresmanor.pages\/\" target=\"_blank\" rel=\"noopener noreferrer\">publicwww results for amp-samaresmanor.pages<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>\u010ce se v iskalniku na tvoji domeni za\u010dnejo pojavljati spam strani, na frontendu pa je vse videti normalno, ne gre nujno za &#8220;klasi\u010den&#8221; redirect. V zadnjem \u010dasu se \u0161iri bolj selektiven pristop: zlonamerna koda prepozna prave Google crawlerje in jim servira drugo vsebino kot uporabnikom.<\/p>\n","protected":false},"author":46,"featured_media":94,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[56,57,54,55,10],"class_list":["post-103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-varnost","tag-googlebot","tag-incident-response","tag-malware","tag-seo","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/posts\/103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/comments?post=103"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/posts\/103\/revisions"}],"predecessor-version":[{"id":149,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/posts\/103\/revisions\/149"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/media\/94"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/media?parent=103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/categories?post=103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/sl\/wp-json\/wp\/v2\/tags?post=103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}