---Q---

I did the same Google search and yes, we do use the ManageWP Worker plugin. But, I can’t see the cloner.php file anywhere. I’m guessing the plugin uses the file when it automatically takes a monthly backup.

• This reply was modified 4 years, 4 months ago by ---Q---.

Don’t know if it helps or not but the last Plugin updates were done on the 22-Jul-2020. I’ve added several galleries since then without any issue.

Would these be the types of error messages that you’re looking for?

[2020-07-28 02:58:41] [core:error] [client 54.191.137.17:0] End of script output before headers: php73-cgi, referer https://www.pro-rally.co.uk/cloner.php
[2020-07-28 02:59:30] [core:error] [client 54.191.137.17:0] End of script output before headers: php73-cgi, referer https://www.pro-rally.co.uk/cloner.php
[2020-07-28 03:00:17] [core:error] [client 54.191.137.17:0] End of script output before headers: php73-cgi, referer https://www.pro-rally.co.uk/cloner.php
[2020-07-28 03:01:06] [core:error] [client 54.191.137.17:0] End of script output before headers: php73-cgi, referer https://www.pro-rally.co.uk/cloner.php
[2020-07-28 05:04:17] [authz_core:error] [client 173.212.241.58:0] AH01630: client denied by server configuration: /mnt/web/ns/std/5/9/8/pro-rally.co.uk/web/robots.txt

Duplicate doesn’t work. Same thing happens – Page reloads, hamburger briefly spins. Most recent gallery is shown (not duplicated).

Screenshot

Not seeing any errors.

• This reply was modified 4 years, 4 months ago by ---Q---.

Hi All and thanks for the replies. I did pretty much everything that was suggested in the link from the first poster (Mark podz). My ISP detected the ‘FileMan’ exploit was being used – a file titled ‘index.php’ had been placed in the images folder of my theme. I removed this, checked the other files and the database and no damage or changes seem to have been made.

I’ve changed my WP and FTP passwords as suggested. I’ve also done the Fetch as Google thing from my Webmaster tools and the pharmacy words are not appearing. But that’s the strange thing – they never have. I’ve checked my posts and pages, my images and my DB and the pharmacy words appear nowhere other than Google.