WordPress.org

1. matthewpaul
   Member
   Posted 2 months ago #

   My site was not loading earlier, as I received a parse error referencing the general-template file located inside wp-includes. After replacing the file with a local copy, the issue was resolved.

   I opened the general template file that had the problem and compared it to my local version. The bad file had this code inserted in it which prevented the site from loading:

   <?php
   //LINKBLOCK
   //LINKBLOCK
   ?>

   Does this mean my site was hacked? If so, would simply replacing this file fix the issue from happening again? I was running the latest version of WP, changed my pws, and looked through my files via FTP and didn't notice anything else that was strange.

2. matthewpaul
   Member
   Posted 2 months ago #

   Any help is appreciated.

3. alism
   Member
   Posted 2 months ago #

   Hmmm, doesn't sound like a hack to me. What plugins are you using? Is LinkBlock one that you've used previously?

4. matthewpaul
   Member
   Posted 2 months ago #

   No, just Akismet, Google XML Sitemaps, and Subscribe To Comments.

   That PHP line of code, which appears to have been maliciously added, blocked my site from loading.

5. alism
   Member
   Posted 2 months ago #

   I'm not saying that it definitely isn't a hack, it's just that code wouldn't actually do anything. It's just a PHP comment. A hack would normally insert malicious code, to either add spam links, a defacement or to try and either redirect the visitor to another site or install malware on their pooter.

   Can you look through your server logs around the time to the file was altered to see if you can spot anything else suspicious or out of the ordinary?

6. samboll
   moderator
   Posted 2 months ago #

   a link to your site and we could maybe verify

7. whooami
   Member
   Posted 2 months ago #

   theres NO forgivable reason, why any file living inside wp-includes/ should be edited, or magically turn up to have been edited by a plugin

8. matthewpaul
   Member
   Posted 2 months ago #

   http://matthewpaul.com

   I know it's just a comment that was added, but the ?> is what closed the rest of the PHP in the file and preventing the site from loading.

9. matthewpaul
   Member
   Posted 1 month ago #

   Anyone?

Reply

You must log in to post.