There are so many free, freemium and premium Themes out there. How can I be sure that a Theme I download doesn't have malware in the code? Is there an (relatively) easy way to check for malicious code without going through every line of code?


You should try using the theme check plugin at http://wordpress.org/extend/plugins/theme-check/


Antivirus Check for Wordpress themes: http://wpantivirus.com


Make a cross file search for eval. If you find this one then the author (or someone who ripped it) has something to hide.

  • I make use of eval in a custom template engine while modifying dom trees. Does that mean I'm trying to hide something?
    – Twifty
    Oct 9 '13 at 4:48
  • @Waldermort There's absolutely no need to use eval to modify DOM trees. You got DOMElement and DOMDocument for that. If this isn't possible, then you'll have to elaborate. Further: Read the question title. Then tell me this isn't a valid answer. Anyway, if you're using eval, then you're probably doing something wrong/misusing something.
    – kaiser
    Oct 9 '13 at 10:55
  • After I have parsed a DOM tree (and stored references to nodes of interest), then merging that tree into another document, those references become invalid. I solved this by instead of storing a reference, I store the path ie. ->childNodes->item(2). After the whole DOM has been inserted into another document, I can quickly get a reference to those nodes using eval. Granted this can be done using arrays and loops (XPath has a lot of branching) but eval is much cleaner and easier to read. Your answer of has something to hide is plain wrong.
    – Twifty
    Oct 9 '13 at 11:38
  • @Waldermort as we're already arguing about that :) ... I'm not able to imagine your setup completely - would have to see that in code and understand what your idea, task and goal is. You know that WordPress got the Filesystem API? And the DOM* classes are really easy to use and much less expensive to search than with Regexes or than storing references in the DB. And then there's the separation of concerns: Such stuff doesn't belong in a theme. It's plugin material.
    – kaiser
    Oct 9 '13 at 11:49
  • Since you mention it, my code is in a plugin, but could easily be extended to a theme. Infact, imagine a twig or DJango based theme. I make use of the DomDocument API directly in an effort to implement a template inheritance where HTML elements can be inserted into the main page by plugins (yes plugins for my plugin). Storing the path to a DomNode and later referencing with an eval enables me to use the same DOM across documents, store the state in WP's settings and perform expensive searches/validations only once. The same could be done with XPath with a performance cost.
    – Twifty
    Oct 9 '13 at 12:02

Look for <hidden> <iframe> <eval> <height=0> <width=0>

Lot's of real life detection for malicious injections in the website files: http://quttera.blogspot.co.il/search/label/Web%20malware%20scan%20reports%20and%20analysis

Look for similar stuff in your website files.

To do the whole sitecheck from your WP dashboard for exploits and malware use this one: http://wordpress.org/extend/plugins/quttera-web-malware-scanner/

  • hidden can be used for form input fields, eval is used in template engines, height=0 and width=0 can be used to hide screen reader texts. You are misleading people into thinking that these strings are all malicious.
    – Twifty
    Oct 9 '13 at 4:52
  • @Waldermort I believe it is obvious that my answer implied that NOT the tags THEMSELVES are malicious but that you might want to start from reviewing what's under the hood.
    – max81
    Nov 4 '13 at 16:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.