someone hacked the WP site. and added popup ads.

My website hacked by someone and he added some propeller ads popup code on my site. I was not able to find that script, I tried removing all the plugins from the site and turn to basic WP theme also.

how is it possible?


when i load the site, i can see a small script running on load, and i can see the publisher id of that hacker.
i used some plugins to find the script running on site when site loaded. but there is nothing in WordPress.

any idea where he added the script?

hardik9099 said:

My website hacked by someone and he added some propeller ads popup code on my site. I was not able to find that script, I tried removing all the plugins from the site and turn to basic WP theme also.

how is it possible?


when i load the site, i can see a small script running on load, and i can see the publisher id of that hacker.
i used some plugins to find the script running on site when site loaded. but there is nothing in WordPress.

any idea where he added the script?

Click to expand...

The code could be hidden in any number of files.

The best and easiest thing to do if your site gets hacked is to delete all your files and then upload a backup. It is much faster and safer than trying to find where the code is hidden. Last time I had to do this to a site the whole process took 10 minutes. Remember all your posts and pages are in your database so you do not lose any info other than maybe some recent updates.


If you do not have a backup you have a couple of choices.

Download all the php files and then run grep on them searching for a code snippet from the hack. The problem with this or any other cleaning method is you will never be 100% sure you get all of it as there may well be code hidden to reinstall the hack after the cleaning.

Temporarily install a new version of your site locally or on a different domain, use the same theme, plugins etc. Basically you are manually creating a clean backup. Once you have this done you then delete all the files on your current hacked domain and upload the backup you created.

If you use this method make sure you create the same exact setup that you are currently using otherwise you will have problems with your site not working properly.

Once you have your site clean you need to harden it and if you have not been doing backups you need to start.

volund said:

Download all the php files and then run grep on them searching for a code snippet from the hack. The problem with this or any other cleaning method is you will never be 100% sure you get all of it as there may well be code hidden to reinstall the hack after the cleaning.

Click to expand...

If you use this method, also make sure to download any .js files (if there are any). Hackers can inject script code in these existing files.

its possible via ur hosting provider too so be carefull

check your functions.php file. I experienced that problem about 3 weeks ago. Discovered some code had been inserted. I deleted it and changed the file permission to 444

I've had this happen to some of my sites.

There is two files hiding in the WP-admin folder.

And then some code in functions.php. But if you try to delete the code in functions, the files hiding in wp-admin will callback and rewrite your functions...

Google snippets of the code in functions and you'll find your answer good sir

I would recommend to see if your host has a clean backup that could be loaded. One of the neg draw backs to using wordpress sites. Way to easy for these guys to hack and just do that. Those files could be hidden in a number of different files. You could also ask your host to run a scan on your site if they don't have backup.