{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 劳资没心，怎么记你 的问题《wordpress viagra hack in header》','https://www.manongdao.com/q-968374.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
I can see a hack in the header of my Wordpress site for viagra in a hidden div but I don't know where to remove it. I have looked at some of the php files but I can't see code. I can see the hack on a mobile (android) and firefox.
相关问题
- Display product ACF field value in Woocommerce tra
- “Zero out” sensitive String data in Swift
- Adding a custom button after add to cart button in
- How to add a “active” class to a carousel first el
- Setting custom order statuses as valid for payment
相关文章
- wordpress新增页面如何个性化设置
- Warning : HTML 1300 Navigation occured?
- select query in wordpress
- Get WooCommerce featured products in a WP_Query
- Woocommerce update shipping methods in checkout vi
- Security concerns about CORS
- How do I prevent SQL injection with ColdFusion
- Change order status just after payment in WooComme
Here are the steps I would take to find and eliminate this:
Look in the header.php file of your theme. This would be /wp-content/themes/child/header.php. In particular, look just below the body class and comment out any functions or PHP code you might find directly below this to see if there is a malicious function being called. The body tag probably looks like this:
<body <?php body_class($class); ?>>
Deactivate all plugins on the site and check to see if the problem still persists. If it doesn't, then enable the plugins one by one until you find the culprit.
It looks like maybe they could be hooking into the body_class filter. Run a text search across all of your template files for a body_class filter, which will look like this:
add_filter( 'body_class', 'filter_function_name' )
You'll want to search for add_filter( 'body_class and add_filter('body_class to catch possible differences in the whitespace.
Hopefully you'll find something.
Look everywhere. If one file has been compromised, then there's no reason to suppose that your other files are all safe.
Your best bet is to delete WordPress entirely, check your database thoroughly for content added by the hackers, change all your passwords (including site admin, MySQL and FTP) and then reinstall WordPress over the same database. But this time, be very careful when choosing themes and plugins. It's really not uncommon for nice-looking WordPress themes to have gaping security flaws.
For what it's worth, here's a PHP script that I wrote to disinfect a site with a similar problem. It may not work on your site, but it should give you some idea of what to look out for.