Some hacked sites now carry hidden scripts that use visitors' processors to mine cryptocurrency, slowing their devices and getting the site blocked. Removing the script is easy; closing the way in is the job.

A laptop fan on one particular website

A customer mentions, almost in passing, that their laptop fan roars whenever your website is open.

The site looks exactly as it should. Nothing is defaced, the forms work, and the pages load.

But somewhere in the code, a few lines nobody added are doing arithmetic for a stranger, on the processor of every computer and phone that opens the page.

Since last fall, it has become a common find on hacked small business sites.

How mining in a browser works

Some cryptocurrencies are created by computers working through long series of calculations, and whoever's computer finds an answer is paid in the currency.

A few can be mined on ordinary processors, so a script in a web page can do the work for as long as the page stays open.

Ready-made mining scripts appeared last year, pitched at site owners as an alternative to advertising. They were soon being planted on sites whose owners knew nothing about it.

The visitor's device does the work and pays for the electricity. Whoever planted the script collects the currency.

How it gets onto a small business site

The fifth is the one that surprises people. Earlier this year, a widely used website tool had its script altered at the source, and for a few hours every site loading it served a miner.

What visitors notice

Mining scripts take as much processor time as they can without being noticed, so a desktop computer simply runs warmer and louder than usual.

On a laptop, the fan starts and the battery drains faster. On a phone, the handset warms up and everything feels sluggish while the page is open.

Security software and ad blockers have started treating known mining scripts as unwanted, so some visitors see a warning or a blocked page instead of your site.

Most visitors will say nothing. They will leave, and remember your site as the slow one.

Why the owner often sees nothing

The work happens on the visitor's device, not your server, so your hosting figures look normal.

Many injected scripts also hide from the people most likely to spot them. Some skip visitors logged in as administrators. Some run on only a share of visits, or only on desktop computers.

And the office computer may have security software that blocks the script quietly, so the owner browsing the site at work never sees it run.

How to check

Use a computer without an ad blocker, load the site in a private window, then leave a page untouched for a couple of minutes.

Watch the processor while you wait: Task Manager on Windows, Activity Monitor on a Mac, or Chrome's own task manager under More tools. A page that sits still while the processor works hard is the warning sign.

Then look through the page source, near the bottom especially, for scripts from addresses you do not recognise.

A clean result is not proof, since the script may run only on some visits. If a customer has mentioned it, have the files and the database scanned properly.

A worked example

An antique dealer on an old main street had a WordPress site whose gallery plugin nobody had updated in over a year.

A customer told staff at the counter that the website made her laptop sound as if it were about to take off. The owner checked on his own computer and saw nothing.

He was logged in as an administrator, and the script skipped administrators. The web company found it in the theme's footer, with a second copy in the database and an administrator account nobody at the store had created.

The way in was a known flaw in that plugin. The scripts and the account were removed, the gallery replaced with a maintained one, every password reset, and the files checked against clean copies.

The clean-up

Deleting the visible script is the easy part, and on its own it rarely lasts: attackers usually leave more than one copy, and a way back in.

A proper clean-up keeps a copy of the infected site for reference, then searches the files, the database and any scheduled tasks for every copy of the script.

Core files, themes and plugins are replaced with clean copies rather than edited, everything is updated, and anything unused is removed.

Every password changes, and any account nobody recognises goes. Then the site is watched for a few weeks, since reinfection within days means the way in is still open.

Keeping it out

Most prevention is unglamorous: updates applied promptly, unused plugins and old copies deleted, and a unique password with a second login step on every account that can change the site.

Two technical measures help too. A content security policy is a setting that tells browsers which outside servers your pages may load scripts from, so a script injected from anywhere else is refused.

Where the site loads a script from another company's server, an integrity check can be added, so most current browsers refuse the file if it has changed.

The counter-case

Not every warm laptop means a hacked site. A heavy page can work a processor hard, and a browser extension on the visitor's own computer can carry a miner of its own.

If the problem appears on one computer only, check that computer first. If it appears on several, in private windows, the site is the common factor.

A few sites run mining openly, with visitors' agreement, in place of advertising. On a business site, a miner you did not add is a hack.

Check from a clean computer, and have the site cleaned by somebody who closes the way in as well.

This week

  1. Open the site in a private window.
  2. Watch the processor for two minutes.
  3. Read the page source for unfamiliar scripts.
  4. Update every plugin, theme and core file.
  5. Delete forgotten copies of the site.
  6. Change the hosting and site passwords.
  7. Remove accounts nobody recognises.

Step four is the one that keeps the problem from coming back. Removing a script while the outdated plugin stays in place is cleaning a room with the door left open.

Why a site with a padlock can still be serving something it should not is covered in a padlock does not mean a site is honest.

Frequently asked questions

What is a cryptomining script on a website?

A few lines of code, usually planted by an attacker, that use each visitor's processor to mine cryptocurrency while the page is open. The visitor's device does the work; the attacker is paid.

How does it get onto a site?

Usually an out-of-date plugin or theme with a published flaw, a weak or reused password, a pirated theme, a forgotten copy of the site, or a third-party script altered at source.

What do visitors notice?

Fans spinning up, laptops and phones running warm, batteries draining and sluggish browsers. Security software and ad blockers increasingly block known mining scripts, so some visitors see a warning instead.

Why does the owner not see it?

The work happens on visitors' devices, not the server, so hosting figures look normal. Some scripts also skip logged-in administrators, run on only some visits, or are blocked by office security software.

How can I check my own site?

Open it in a private window on a computer without an ad blocker, leave a page idle for two minutes, and watch the processor. Then look for unfamiliar scripts in the page source.

Is deleting the script enough?

Rarely. Attackers leave extra copies and a way back in. A proper clean-up replaces files with clean copies, updates everything, changes every password and removes unknown accounts.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Customers mentioning a noisy laptop?

Send us the address. We will check for mining scripts and close the way in if we find one.

Start a Conversation