Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This had been added to our wordpress site, specifically in the footer.php.


It is malware as defined by google, i belive it is tracking code.

We have complex passwords and use https for /wp-admin. We do not however block access to /wp-admin using htaccess - but that would not have stopped this ?

How do they occur, how can I stop them ?

share|improve this question
There are many potential ways to attack a Wordpress install (or any web app for that matter). For a start you should read – Joel L May 3 '13 at 14:48
You're inquiring about causes yet you only provide post-injection information. It's impossible for us to give you a meaningful answer, considering information we have available. Go through your web server's and CMS's log files and look for any relevant or otherwise fishy entries just before this injection happened, then add that data to your question. You might want to inspect timestamp of the file or database record involved (where this injected JS is called from) and go up from that time in your logs. You'll be looking for curious looking GET request URIs and/or POST/PUT requests. – TildalWave May 3 '13 at 18:03

The difficulty with these sort of code injections is that if you are using a hosted service provider is it possible for the infections to spread between the various clients hosted. It may not be your actual installation of WordPress that is the problem.

Another thing you can ensure is that all of your plugins and your WP is up to date. Following the hardening procedures are another thing to help with that.

I also recommend installing the WP BulletProof Security plugin.

share|improve this answer

It can also be a FTP injection. Basically a PC with FTP access to the server that has passed the FTP details to a third party who then change the files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.