PHP Code is not legit (new user)

Hi @krahentash1

(Disclaimer: I am not a Wordfence staff member, just a fellow WordPress user/developer, but here is a clear plan to help get your site back under control.)

What you are describing is a classic redirect injection (often paired with SEO spam or malicious scripts injected into core files/database). Wordfence is flagging an unrecognized or modified PHP file because the attacker likely placed a backdoor or edited an existing file.

Here is the recommended sequence to isolate and clean this up:

1. Take an immediate backup

Before modifying or deleting anything, generate a full backup of your site files and database via your web hosting control panel (cPanel/Plesk/hPanel). Even a infected backup is crucial so you don’t accidentally lose site content or media if a cleanup goes wrong.

2. Complete Wordfence Setup & Run a Deep Scan

Even though Wordfence flagged the file:

1. Go to Wordfence > Scan > Scan Options and Scheduling.
2. Select High Sensitivity (this will scan image files for injected code and check outside WordPress directories).
3. Click Start New Scan.
4. Wordfence will list the suspicious files and give you the option to view differences or delete/restore original core files.

3. Replace WordPress Core Files

Malicious scripts often hook into standard WordPress files:

• In your WordPress Admin, go to Dashboard > Updates and click “Re-install version [x.x]”. This replaces all official WordPress core files with fresh, clean copies while keeping your content and plugins intact.

4. Check Root Server Files Manually (via FTP or Host File Manager)

Attackers frequently modify root directives to force the redirects you noticed:

• .htaccess (Apache / LiteSpeed): Check if there are rewrite rules redirecting search traffic or specific user agents. You can replace it with the default WordPress .htaccess.
• index.php and wp-config.php: Check the very top of these files (before <?php or right below it) for long obfuscated strings (eval(base64_decode(...)) or strange include/require lines).
• .user.ini or php.ini: Look for directives like auto_prepend_file pointing to rogue .php or .ico files.

5. Reset Credentials & Invalidate Sessions

Once the files are cleaned:

• Change your WordPress Admin passwords, database password, FTP/SSH credentials, and Hosting account password.
• In your hosting file manager or via wp-config.php, update the WordPress Security Salts (WordPress Salt Generator) to automatically log out all active sessions, including any the attacker might have open.

Wordfence team members monitor these forums regularly and will likely respond with their standard cleaning guide as well, but starting these steps now will help stop the redirect and prevent further damage.

Thank You

Hi @krahentash1

The “Permission denied” error happens because the malicious file or directory has strict file permissions, or it is locked by an immutable attribute (chattr +i). Because PHP running through Wordfence doesn’t have elevated server rights, it can’t delete it automatically.

Here is how you can remove it:

1. Delete via Hosting File Manager or FTP (SSH)

• Log into your hosting control panel (cPanel, Plesk, hPanel, etc.) and open File Manager.
• Navigate to wp-content/uploads/.
• Enable “Show Hidden Files” (dotfiles) in your File Manager settings so you can see .cache.
• Change the file permissions (chmod) of .30d77af1.php and the .cache folder to 755 or 777.
• Delete the file and folder manually.

2. Check for File Immutability (If on SSH/VPS)

If you have SSH access and still can’t delete it as root or cPanel user, run:

lsattr wp-content/uploads/.cache/.30d77af1.php

If it has the i (immutable) attribute set, unlock it first:

chattr -i wp-content/uploads/.cache/.30d77af1.php

Then delete it:

rm wp-content/uploads/.cache/.30d77af1.php

3. Contact Hosting Support

If you don’t have SSH access or file manager permissions, reach out to your web hosting support team and give them the exact error message and path. They can delete the locked file from the root level in seconds.

Once deleted, continue with replacing the WordPress core files and updating your credentials as mentioned above!