WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Several months ago my site (powered by WordPress) got hit by that webarh malware infection that set up a bunch of .htaccess redirects to its domain. Restoration of a good site backup nixed the problem, but apparently not entirely.

Specifically, whenever I use Chrome, I log into my website's admin panel, and either edit an existing post or add a new post, as soon as the page finishes rendering I'm immediately kicked out to Chrome's warning page about my site containing content from this malware site.

I've done a MySQL search of all post_content and comment_content, as well as ran a grep through all the PHP/JS/CSS files I can find, in addition to searching for any remaining rogue .htaccess or index.php files, to no avail. As I mentioned, it happens the moment the post.php or post-new.php finishes rendering and just before any existing text shows up in the box. This leads me to believe it's a plugin that's somehow associated with the text editor that's infected, but I'm not really sure where to look.

Also, Firefox issues no warnings at all and allows me to edit as usual. Only Chrome does this (and has been ever since restoring the site). Any thoughts would be appreciated!

Edit: In the interest of full disclosure, this is my site: www.magsolweb.net . Again, everything seems to be fine, except when adding a new post or editing an existing one.

share|improve this question
up vote 0 down vote accepted

Switch to twentyten or another theme for a second and make a test post. That will eliminate the theme.

And replace all WP core files folders with ones of the same version; it could still be hiding there. Just upload them; don't do an install. This is a typical hack fix.

Or, if you did completely clean the site, it could be a a fluke of the theme's js - or a plugin - that is throwing a signature that Chrome interprets as malware.

share|improve this answer
Replaced all the core files, and it no longer throws any warnings. I guess there was a hidden reference somewhere that I just couldn't find. Thanks very much! – Magsol Jul 22 '11 at 14:47

Register your site with Google's webmaster tools. This will give you more information about your site's malware problem. If you can give your website address then maybe someone here can identify what is wrong with it.


share|improve this answer
I set up webmaster tools for exactly that reason a few months back when I couldn't figure this out...so far, the Malware tab still lists "Google has not detected any malware." Like I said, though, it only seems to happen with adding new posts or editing existing ones, so without admin access I don't know how malware detection would find it. – Magsol Jul 21 '11 at 20:59
Oh I see. Good point. That makes it hard to give us access too since we would need admin rights to your site. Have you tried toggling themes? You may want to reinstall the default twenty ten theme. Then turn it on and see what happens. That will at least tell you if the problem is core WP files or theme files. – mrtsherman Jul 21 '11 at 21:08
Tried toggling the themes, no luck, indicating it was probably in the core files. I used the fix from songdogtech and overwrote everything with a new copy, and it has vanished. Thanks so much for your help! – Magsol Jul 22 '11 at 14:46
Yay, glad you are fixed up. – mrtsherman Jul 22 '11 at 14:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.