advanced-cache.php is a legitimate WordPress drop-in filename used for caching. Its presence does not prove infection. Investigate who created it, whether its code matches the expected caching component and why it changes or returns after removal.
Identify the expected owner
Check which caching product or hosting system manages the site. WordPress lists advanced-cache.php among its recognized drop-ins and associates it with WP_CACHE. Ask the host or plugin maintainer for the expected file source and version. A cache plugin can legitimately recreate its drop-in, so recreation alone is not sufficient evidence of persistence.
Preserve the suspect file for comparison
Before changing a live site, record the path, timestamps, permissions and a hash of the file in a restricted incident workspace. Obtain a trusted reference for the installed component. Compare the code and its included files. Comments, familiar filenames and plausible plugin headers can be copied; assess what the code does rather than relying on its label.
Follow unusual dependencies
Unexpected remote requests, unexplained executable includes or behaviour unrelated to caching deserve investigation. Trace references into other files and database configuration. Do not execute suspect code to observe it on production. If the file appears clean but visitors still see malicious output, inspect other execution paths and cached responses as well.
Repair the source of the change
A confirmed malicious drop-in may be only one affected component. Coordinate a clean replacement with the cache owner and check why the attacker could write the file. Review related plugins, must-use plugins, scheduled activity and privileged accounts. Blindly deleting all drop-ins can break cache, database or host functionality without resolving the underlying compromise.
Check after cache regeneration
After approved cleanup, rebuild caches through the legitimate tool and verify the drop-in remains the expected version. Test both logged-out pages and administrative functions. Observe whether the suspicious file or dependency reappears. If it does, preserve the timing and investigate the writer instead of repeating deletion as the entire recovery plan.
Questions about this problem
Is advanced-cache.php always malware?
No. It is a recognized WordPress cache drop-in. Its origin, code and behaviour need to be assessed.
Why did the file return after deletion?
A legitimate cache component may regenerate it, or another component may be writing it. Identify the writer before deciding it is reinfection.
Primary references
General diagnostic guidance, not a diagnosis of an individual site. Use a recoverable copy for changes that may affect production.