- July 11, 2020 at 3:23 pm #281518
I’m using sparkling-child theme which works fine.
Except every morning, my site is screwed up because the file functions.php does no longer exist. I restore it every morning and the site is fine then but it happens again the following night.
As you can see on the picture attached, the sparkling-child directory is updated every night at 2am (Aujourd’hui à 2.24) ! I noticed the functions.php file is no longer present in the sparkling-child directory. I promise, i am in bed at that time and i don’t do anything
Any idea who or what is doing that to me ?
Thanks for your answers
Attachments:July 13, 2020 at 10:06 am #281651
For sure this is not something that theme or WordPress capable to do, first of all, I would recommend to use some malware scan plugins like Wordfence, other way is to contact hosting support
ThanksJuly 13, 2020 at 8:35 pm #281692
OK. Thanks. I’ll do thatJuly 14, 2020 at 5:24 am #281699
You are welcome
Have a great day 🙂July 22, 2020 at 5:06 pm #282339
I installed wordfence and contacted my hosting support : effectively, it was one of their security process which was deleting my file functions.php every day.
So the problem is now to concentrate on the file iself. wordfence detected a problem :
File Type: Not a core, theme, or plugin file from wordpress.org.
Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: $div_code_name=”wp_vcd”;
The issue type is: Backdoor:PHP/WP-VCD.5473
Description: Backdoor used for backlink injection and other malicious activity.
Should i attach the functions.php file so you can anlyse it ?
FrancoisJuly 23, 2020 at 4:18 am #282351
Thank you for coming back, no need to attach a file, probably you can easily solve this problem, just reinstall theme and observe it again, most probably only funciton.php file is affected and if you change it with original it should fix your problem
- You must be logged in to reply to this topic.