I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in the static pages created by w3 total cache.

How can I find out what part is responsible for this? The obvious answer would be the w3 total cache plugin itself, but the pgcache is actually writeable by any part of wordpress so it might be any other plugin or even the WP core.

I have searched the web for this problem but found nothing directly relevant.

Of course wordpress is updated to the latest version available (3.0.2) as is every installed plugin. It does not depend on the theme as it happened with two different ones.

3 Answers 3


It is prolly injected in your files. Look at the plugin files, search for eval or base64.

  • I found malicious code hidden in a couple of plugins and even inside wp-includes/js/tinymce Dec 8, 2010 at 15:46

I doubt the W3 cache is targeted. More likely is that spam is not injected in page for admin users, so you don't see anything in non-cached version, but regular page does contain spam and so it gets cached.

As usual there are plenty of info around on cleaning up hacked sites, starting with FAQ My site was hacked in Codex. But really it's very case by case.

Clean reinstall and restore from known good backup is best bet, if not possible you are up for a lot of manual work (or hiring someone who specializes in such issues).

  • But if I disable the page caching, the same page shows no spam to an unregistered user. That's why I assumed that spam is injected only in the cached version. Dec 8, 2010 at 10:02
  • @kemp another possibility is that spam is only injected for search engines by user agent. Google webmaster dashboard has function to request page as their bot sees it. Alternatively I think there are Firefox plugins around that allow to fake user agent.
    – Rarst
    Dec 8, 2010 at 11:08
  • I know it is case by case by my sites seem to have injections in them about every week. wordpress file monitor usually gives some warning about the added files and sometimes not e.g. changes made in footer.php are not reported but after I remove the injected code the change is reported... anyway... handy plugin to install.
    – edelwater
    Dec 8, 2010 at 23:01

I found a Script to find base64 in files. Until I found this, I was going in circles. Once you clean up your files, be sure to set permissions, read-only for all of them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.