I have a wordpress website always updated. I'v developed a theme from scratch for it, so my theme is clean as it was always. I use strong passwords generated by specific tools. Last 3 days my website is infected by a code that redirect my website to linkbucks ads. I'v found that this was coming from a code injected into header.php or footer.php files of my theme. I'v cleaned my theme, re-uploaded wordpress core file from a new copy, changed FTP username and password, changed my admin wordpress password, but after all that the code reappear! So I try to contact my web-hosting (Godaddy), because the problem maybe coming from a bug on the server or another website hosted on the same server as my website (I'm using shared hosting), but didn't receive helpful reply from Godaddy support. Now I don't know what to do, I just delete the code after the hacker add it, I'v changed passwords several times, but the problem is still present. I'd like to know if I someone know something about this malware, because after googling for 5a9fa481.megaline.co there is no result. Maybe it's something new. If I can deny any modification to header.php and footer.php files I think this can help me until finding an efficient solution. Can you help me please? Any suggestions? (Btw, sorry for my bad English)

  • 1
    Do you have any plugins installed? It's quite likely that the hacker is just automatically exploiting a known vulnerability in a plugin. You should disable any plugins not in use. Also consider disabling all plugins temporarily and installing a security scanner/auditor plugin, which will help you find many possible weak points.
    – elixenide
    Commented Dec 12, 2013 at 20:44
  • Thanks for you reply Ed Cottrell. I actually deleted unused plugins, and also used BulletProof Security plugin. In fact the hacker was able to inject his code while BulletProof Security was installed, but now I'v locked header.php and footer.php files using 400 chmod, I think it's impossible for it to edit these ewo files, except if it can change chmod on the server, in such situation maybe the problem comes from the Godaddy, but I hope it can't.
    – Abdelhadi
    Commented Dec 12, 2013 at 21:42

1 Answer 1


If you can view the access logs for the site that can be helpful. I've been able to find the attack vector for wordpress sites this way in the past. If there's nothing there then it's likely it's coming from someone else on the host. Perhaps you could move it to digital ocean ($5 per month for a VPS) to rule out being a problem with the shared host.

  • Hi @Justin B. Thanks for your reply. Actually I'v looked for log file, but I didn't find any trace except redirection to ads page when a visitor visits my website. Now I'v locked header.php and footer.php as I said to Ed Cottrell, and I'll wait if the hacker will be able to inject the code. I believe that the attack is coming from someone else on the server, but Godaddy isn't helpful.
    – Abdelhadi
    Commented Dec 13, 2013 at 8:18
  • Good luck, I hope you are able to nail it down. I was able to identify some issues with a wordpress install today using ossec. That won't help you in this case but I thought it was interesting that it turned up some infected files that at least three other scanners missed.
    – Justin B
    Commented Dec 14, 2013 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .