The active theme’s functions.php loads on many WordPress requests, making it a common place for attackers to add redirect loaders, hidden admin creation, remote code fetchers or reinfection logic.
Symptoms
- Malware returns after replacing other infected files.
- Theme functions.php contains unfamiliar encoded or obfuscated blocks.
- Unexpected scripts, users or redirects are recreated after requests.
- File modification time changes without an authorized deployment.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
Attackers use a frequently loaded theme file as a persistence point. The modification may be the primary backdoor or only one layer in a broader compromise.
Investigation and recovery
- Compare the theme with a known-good source or version control.
- Separate legitimate customizations from unauthorized code.
- Remove backdoor logic and any files/users it created.
- Investigate credentials, vulnerable plugins/themes and hosting access that allowed the change.
- Monitor file integrity after recovery.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Can I replace functions.php with a clean copy?
Only if you know there are no legitimate customizations that would be lost. A child theme or custom code may require careful merging.
Why does malware often target theme files?
They execute on many requests and may be writable through compromised admin, plugin vulnerabilities or filesystem access.
Is base64 always malware?
No. Encoding can be legitimate, but dense obfuscation in an unexpected location is a strong reason for manual review.
Will changing the theme fix the hack?
It may stop one payload, but other persistence mechanisms and the original entry point can remain.
Seeing signs of functions.php Backdoor?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident