audacity45

Yeah but like how is it possible to redirect? Im not seeing anything in the plugin or theme. Do you have any idea where such code might be placed.

I did that.Deleted redirecting js plugin. But few days later a different file of different plugin being redirected. Same code. So maybe the server is comprimised? But I check logins and none there. Its a openlitespeed server. No suspicious logins on there either.

It extended that files code and adding a popunder ad code to it. Ex if my js files contains login code. It keeps the same code and just adds some more popads code to it. Likely popcash ads. Whats weird is i cant understand how are they redirecting. I checked the database. Fresh install all files. Still cant seem to remove it.

Hello, I fixed the problem. I had some PHP updates pending. As soon as I updated PHP the problem disappeared. So the problem was mostly with PHP it seems for me at least.