Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website?

I opened few files using a text editor and removed the <iframe> code. Also, changed all my FTP password. How can I ensure that my site is clean now? What are all the preventions I can take to avoid this in futre?

  • I could not add iframe,virus and blog tags since I don't have efficient reputation. Sorry, if the tags are wrong.
    – San
    Commented Jul 28, 2010 at 12:07
  • I added you iframe, blog and virus are redundant since there is wordpress and security already.
    – HoLyVieR
    Commented Jul 28, 2010 at 12:21

5 Answers 5


Cleaning a WordPress install, or any site, of such files is generally straightforward. If there's a pattern, do a search of the relevant files and then replace the bad code.

In the case of WordPress, there are a few different sources of bad code (probably others):

  1. An already infected theme was installed
  2. Your site's FTP password was guessed and hacked
  3. WordPress is insecure and allowed a worm to be installed

One thing you can do is install TAC (Theme Authenticity Checker), which will scan for the bad stuff.

See Hardening WordPress for steps to take to make WordPress more secure. But basically when I've seen this happen what I do is back everything up (database and all files), then blow that install away and install a fresh WordPress install, fresh replacement plugins, and a fresh theme (if your theme was custom, get rid of the bad code first!).

Googling for "wordpress infection" should get you other articles with similar advice.


Obviously, always make sure you have the latest version of Wordpress installed. The admin panel tells you when WP needs updating. If you don't log in too often, you could follow the wordpress.org blog feed to keep on top it.

Every time you download a new theme you should search through the source code for any use of base64_decode or eval (Notepad++ makes this easy), this is the primary way to hide malicious code or spammy links. You can copy the encoded HTML/PHP into an online base64 decoder if you like, to see what it's actually doing.


Are you running on a shared server?

I've previously seen on shared servers instances where one account has been hacked and it's been possible for the hackers to access other sites on the shared server through files which the PHP users has access to.

  • If this is the case, you should get your host to use PHP's "safe mode" which protects against this sort of thing. Commented Jul 29, 2010 at 13:16
  • Yes, Loftx. It's a shared server. How can I prevent these kind of attacks?
    – San
    Commented Jul 30, 2010 at 12:24
  • @DisgruntledGoat How can I check whether it's is safe mode or not?
    – San
    Commented Jul 30, 2010 at 12:25
  • @San: If safe mode is enabled then ini_get('safe_mode') will return true. You could also try one of these functions: php.net/manual/en/features.safe-mode.functions.php Commented Jul 30, 2010 at 14:44
  • Also note that safe mode has been removed as of PHP 5.3 so in that case your host will have to do something else to restrict access. Commented Jul 30, 2010 at 14:47

or you could just do an in-file search and replace of your folders. Because iframes are evil by default...

  • How can I do that? Is there any tool available?
    – San
    Commented Jul 30, 2010 at 12:24

You can use the "Secure Wordpress" plugin which at the beginning was developed by Frank Bueltge. Now sitesecuritymonitor.com maintains it. The plugin contains a method to scan your Wordpress blog against known Vulnerabilities.

See: http://www.sitesecuritymonitor.com/secure-wordpress-plugin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.