Title: suspicious file change
Last modified: August 30, 2016

---

# suspicious file change

 *  [dkirmis](https://wordpress.org/support/users/dkirmis/)
 * (@dkirmis)
 * [10 years, 11 months ago](https://wordpress.org/support/topic/suspicious-file-change/)
 * Hi…I have WordFence installed and it gave me the following alert:
    WordPress 
   core file modified: wp-includes/nav-menu.php
 * Here is the code that has been added (below). Looks very “hacky” to me, but I’m
   new to this. Am I right? If so, can I choose “restore the original version of
   this file” and will that fix it? How did someone get past WordFence?
 * [removed]

Viewing 1 replies (of 1 total)

 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [10 years, 11 months ago](https://wordpress.org/support/topic/suspicious-file-change/#post-6676432)
 * Yep, that’s no good, none of the base64 stuff should be there.
 * Remain calm and carefully follow [this guide](https://codex.wordpress.org/FAQ_My_site_was_hacked).
   When you’re done, you may want to implement some (if not all) of [the recommended security measures](https://codex.wordpress.org/Hardening_WordPress).
 * For what it’s worth, you can always download a fresh copy of WordPress from [https://wordpress.org/download/](https://wordpress.org/download/)
   to compare core files, and nothing and no one should *ever* be modifying core
   files.

Viewing 1 replies (of 1 total)

 The topic ‘suspicious file change’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 1 reply
 * 2 participants
 * Last reply from: [James Huff](https://wordpress.org/support/users/macmanx/)
 * Last activity: [10 years, 11 months ago](https://wordpress.org/support/topic/suspicious-file-change/#post-6676432)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics