WordFence wants me to delete functions.php

PS – according to my file manager, the functions.php was last updated last November.

WF support may jump in here, but in the meantime….

What is Wordfence telling you about functions.php? Is it flagging it as containing malicious code? What error or warning are you seeing?

Thank you for replying! This is what I get with the big red X!

File contains suspected malware URL: /home1/kimmarla/public_html/janektolerphd/wp-content/themes/modernize-v3-13/functions.php
Filename: wp-content/themes/modernize-v3-13/functions.php
Bad URL: https://cloudflare.solutions/ajax/libs/reconnecting-websocket/1.0.0/reconnecting-websocket.js
File Type: Not a core, theme or plugin file.
Issue First Detected: 12 hours 47 mins ago.
Severity: Critical
Status New
This file contains a URL that is currently listed on Wordfence’s domain blacklist. The URL is: https://cloudflare.solutions/ajax/libs/reconnecting-websocket/1.0.0/reconnecting-websocket.js

SO that is the functions.php file for your theme. The file itself is valid, but because it’s warning about containing reference to a malicious URL that could mean either 2 things:

1) your theme has a vulnerability and has been compromised with site malware (more likely)

2) it could also be a false positive (less likely)

If it were me, first thing I would do would be to delete your current theme files completely, and replace them with a fresh copy – do this via FTP upload rather than through WordPress.

If the problem re-occurs, then your site, or your site’s host has been compromised and is allowing hackers to get in, which requires further site/host malware removal techniques.

It’s also possible that your theme itself has a vulnerability that is currently being exploited, in which case the only solution there is to update to the latest version of the theme, or contact the theme authors if you’re already running the latest version.

These 2 articles may also help:
https://www.wordfence.com/learn/has-my-site-been-hacked/
https://www.wordfence.com/learn/how-to-harden-wordpress-sites/

Yikes – thanks so much!

Hi @kimmarla
Exactly as “bluebearmedia” mentioned, I would compare this file with a fresh copy of the theme function.php file, it’s unlikely this URL was included there. After uploading a fresh copy of the theme files, please follow these steps mentioned in “How to Clean a Hacked WordPress Site using Wordfence“.

Thanks.