I have been tasked with investigating a website that has been reported as abusive, I had no prior experience with this website and have no idea why or how things are set up as they are, in my investigations I have found multiple wp-admin folders with numbers on the end of them and a wp-config file that contains a lot of code that I don't believe should be there.

A lot of eval() functions that decode base64 code that when decoded contains globally defined variables like:

 if (!defined('ALREADY_RUN_1bc29b36f342a82aaf6658785356718'))
    define('ALREADY_RUN_1bc29b36f342a82aaf6658785356718', 1);

     $ccexjwtgo = 413; function zscvdwpfe($bmbauwl, $uhkkg){$kirmhhq = ''; for($i=0; $i < strlen($bmbauwl); $i++){$kirmhhq .= isset($uhkkg[$bmbauwl[$i]]) 

I have updated the wordpress install to 4.7, updated all plugins and removed ones I believe to be a problem or unnecessary. Am I safe to assume that this site is indeed compromised? Or is this just some weird stuff imported from a plugin or what?

closed as off-topic by RRikesh, Dave Romsey, cjbj, bueltge, Pat J Dec 21 '16 at 23:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions that are too localized (such as syntax errors, code with restricted access, hacked sites, hosting or support issues) are not in scope. See how do I ask a good question?" – RRikesh, Dave Romsey, cjbj, bueltge, Pat J
If this question can be reworded to fit the rules in the help center, please edit the question.


WordPress core does not contain obfuscated code (with unfortunate exception of revisions easter egg).

While wp-config.php can (and often does) contain arbitrary code, it is not normal for extensions to add anything there and there isn't an API way for it. In a nutshell it is meant to be edited by hand for specific configuration purposes.

I would assume any obfuscated code in that context to be harmful and site compromised.

Not the answer you're looking for? Browse other questions tagged or ask your own question.