WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are so many free, freemium and premium Themes out there. How can I be sure that a Theme I download doesn't have malware in the code? Is there an (relatively) easy way to check for malicious code without going through every line of code?

share|improve this question

closed as too broad by kaiser May 15 '14 at 11:13

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 4 down vote accepted

You should try using the theme check plugin at http://wordpress.org/extend/plugins/theme-check/

share|improve this answer

Antivirus Check for Wordpress themes: http://wpantivirus.com

share|improve this answer

Make a cross file search for eval. If you find this one then the author (or someone who ripped it) has something to hide.

share|improve this answer
I make use of eval in a custom template engine while modifying dom trees. Does that mean I'm trying to hide something? – Twifty Oct 9 '13 at 4:48
@Waldermort There's absolutely no need to use eval to modify DOM trees. You got DOMElement and DOMDocument for that. If this isn't possible, then you'll have to elaborate. Further: Read the question title. Then tell me this isn't a valid answer. Anyway, if you're using eval, then you're probably doing something wrong/misusing something. – kaiser Oct 9 '13 at 10:55
After I have parsed a DOM tree (and stored references to nodes of interest), then merging that tree into another document, those references become invalid. I solved this by instead of storing a reference, I store the path ie. ->childNodes->item(2). After the whole DOM has been inserted into another document, I can quickly get a reference to those nodes using eval. Granted this can be done using arrays and loops (XPath has a lot of branching) but eval is much cleaner and easier to read. Your answer of has something to hide is plain wrong. – Twifty Oct 9 '13 at 11:38
@Waldermort as we're already arguing about that :) ... I'm not able to imagine your setup completely - would have to see that in code and understand what your idea, task and goal is. You know that WordPress got the Filesystem API? And the DOM* classes are really easy to use and much less expensive to search than with Regexes or than storing references in the DB. And then there's the separation of concerns: Such stuff doesn't belong in a theme. It's plugin material. – kaiser Oct 9 '13 at 11:49
Since you mention it, my code is in a plugin, but could easily be extended to a theme. Infact, imagine a twig or DJango based theme. I make use of the DomDocument API directly in an effort to implement a template inheritance where HTML elements can be inserted into the main page by plugins (yes plugins for my plugin). Storing the path to a DomNode and later referencing with an eval enables me to use the same DOM across documents, store the state in WP's settings and perform expensive searches/validations only once. The same could be done with XPath with a performance cost. – Twifty Oct 9 '13 at 12:02

Look for <hidden> <iframe> <eval> <height=0> <width=0>

Lot's of real life detection for malicious injections in the website files: http://quttera.blogspot.co.il/search/label/Web%20malware%20scan%20reports%20and%20analysis

Look for similar stuff in your website files.

To do the whole sitecheck from your WP dashboard for exploits and malware use this one: http://wordpress.org/extend/plugins/quttera-web-malware-scanner/

share|improve this answer
hidden can be used for form input fields, eval is used in template engines, height=0 and width=0 can be used to hide screen reader texts. You are misleading people into thinking that these strings are all malicious. – Twifty Oct 9 '13 at 4:52
@Waldermort I believe it is obvious that my answer implied that NOT the tags THEMSELVES are malicious but that you might want to start from reviewing what's under the hood. – max81 Nov 4 '13 at 16:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.