I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed.

The problem is this SAPE Russian link network that is injecting malware code into the footer.php. Have found the main source code under.. images/cache/'._SAPE_USER.'/cache.php'

I delete the file, even set no write permissions to the footer.php file and still these links manage to appear. Has anyone had experience getting rid of these links. Help would be appreciated cheers.

  • Are you sure they write to your footer.php file or are you just assuming this due to where the links appear in the HTML? I suggest you check your .htaccess file as your explanation suggests they are not dependent on footer.php.
    – wireghoul
    Jan 11, 2015 at 10:19
  • Without a lot more info, we can't solve this problem. I would suggest contacting a professional to go over your server, or to simply nuke the server and restore from backup.
    – schroeder
    Feb 10, 2015 at 19:50
  • Did you solve this? I'd hope so by now as I know how distressing it can be, but if not, I'm associated with a system in beta that would stop this from happening as it detects and blocks any unexpected code in real-time. I'd be happy to work with you as a beta tester with a live use-case.
    – Nick
    Feb 15, 2015 at 12:36
  • Run a text-search for eval( in all of your files, and see if you find anything. 9 times out of 10, eval is malicious. It may not just be your footer... someone may be using another file to infect your footer. Nov 10, 2015 at 15:29

1 Answer 1


Did you run the plugin Wordfence? it checks all files to see if you have any mailicious code present and gives a report. If malicious code is present, many files besides footer will be affected, including false/fake files.

Check the report and remove accordingly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .