Title: Unknown Upload file Last modified: February 20, 2019 --- # Unknown Upload file * Resolved [ronwisely](https://wordpress.org/support/users/ronwisely/) * (@ronwisely) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/) * Hello team , Someone uploaded file on my website . I can’t see any access log. No login attempt [https://snag.gy/NBcD30.jpg](https://snag.gy/NBcD30.jpg) except mine . But when i checked my last change file . Then i found someone made change to wp-content and wp-include . When i checked wp-include then i found someone uploaded these files there [https://snag.gy/RXr7nD.jpg](https://snag.gy/RXr7nD.jpg). So i am confused who is uploading those file . Atleast i could i got login attemp or any access ip in traffic inspector tab . But except mine nothing is there . * Same file got uploaded to another domain wp-include and function.php file at the same time without any login attempt . How can this be possible ? Does my hosting owner is uploading those malicious file on my server ? I am using hostgator and i faced this problem many time . I added almost of security on my website. No one can access my wp-login file because i made the file permission 0000 for login.php with .htacess password based on ip address . With many 50+ secuirty. htacess code . * I can clean my hacked website no issue . But i just want to know is it possible to hack someone’s website without getting tracked ip address because i didn’t find any login attemp or any upload attempt . I can see its a clear trap of Hostgator * Regards, Rahul * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Funknown-upload-file%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 5 replies - 1 through 5 (of 5 total) * Plugin Author [gioni](https://wordpress.org/support/users/gioni/) * (@gioni) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11232947) * Hi! I hope you have not disabled Traffic Inspector? It blocks any attempts to upload files with PHP code. I think those files were created by exploiting some breach (a security flaw) in a plugin, a theme or in a hosting control panel. So a hacker doesn’t even need to be logged in or to upload a file. When a hacker uses this approach, there are no traces except several ordinary requests that do not look malicious. * Thread Starter [ronwisely](https://wordpress.org/support/users/ronwisely/) * (@ronwisely) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11233060) * Respected Gioni (@gioni) , I really appreciate the reply and thnaks for your time .No i didn’t disabled Traffic Inspector And after doing many researched i found they uploaded only one file that is wp-vcd.php in wp-include folder. At the same time in 2 different domain. Last time i remember same time was happening with my client . He was having 50+ domain and same malicious file was getting uploaded on same time on all wp-include folder . * **I am sharing the code which they uploaded on my server ** * ``` ``` * I am sure bots have not done such work because i have added honey trap in wp- include folder and added disallow bots on wp-include folder Even i have added these 2 code on my wp-config file define( ‘DISALLOW_FILE_EDIT’, true ); define(‘ DISALLOW_FILE_MODS’, true ); And file permission of wp-login is 0000 But still they are able to hack upload such code . May i know how i can block request should i make my file permission 444 . Its is done by hosting provider(hostgator) for making extra bucks for malware cleaning service ? * Plugin Author [gioni](https://wordpress.org/support/users/gioni/) * (@gioni) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11235521) * Why don’t you simply scan the website for malware and delete all “Unattended files”? * Thread Starter [ronwisely](https://wordpress.org/support/users/ronwisely/) * (@ronwisely) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11235535) * Respected Gioni (@gioni) sir i already deleted the file . And looking for permanent solution if you possible . Regards, Rahul * Plugin Author [gioni](https://wordpress.org/support/users/gioni/) * (@gioni) * [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11236076) * Keep all your plugins, themes and WordPress up to date. Delete unused themes and plugins. Enable “Protect all forms on the website with bot detection engine” on the antispam admin page. Use the PRO version of WP Cerber which enables you to configure automatic malware cleanup on an hourly basis: [https://wpcerber.com/automatic-malware-removal-wordpress/](https://wpcerber.com/automatic-malware-removal-wordpress/) Viewing 5 replies - 1 through 5 (of 5 total) The topic ‘Unknown Upload file’ is closed to new replies. * ![](https://s.w.org/plugins/geopattern-icon/wp-cerber_77a9bf.svg) * [WP Cerber Security, Anti-spam & Malware Scan](https://wordpress.org/plugins/wp-cerber/) * [Frequently Asked Questions](https://wordpress.org/plugins/wp-cerber/#faq) * [Support Threads](https://wordpress.org/support/plugin/wp-cerber/) * [Active Topics](https://wordpress.org/support/plugin/wp-cerber/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wp-cerber/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wp-cerber/reviews/) * 5 replies * 2 participants * Last reply from: [gioni](https://wordpress.org/support/users/gioni/) * Last activity: [7 years, 2 months ago](https://wordpress.org/support/topic/unknown-upload-file/#post-11236076) * Status: resolved