I have a wordpress site that, for some users, they only see a blank page. In fact, they only get some sort of javascript (below). I've tried deactivating all plugins and changing the theme; I still get the same result. I don't have any compression plugins (like WP-Cache or WP-SuperCache) installed.

What's the problem, and how do I fix it?

  • Recovering from hacks is off topic here per our FAQ. See wordpress.stackexchange.com/q/19696 for further advice.
    – fuxia
    Jun 23, 2012 at 7:17
  • Diagnosing was my goal, actually, not recovery.
    – ashes999
    Jun 23, 2012 at 8:24
  • 1
    The question wasn't about recovering from a hack, but diagnosing what was going on - and it turned out to be a hack.
    – EAMann
    Jun 23, 2012 at 17:44

2 Answers 2


If you've disabled all plugins and switched back to the default Twenty Ten (or Twenty Eleven) theme and are still seeing this, then you've got a serious problem.

First of all, the JavaScript is horribly obfuscated. Second of all, with no plugins and a default theme, you should see the default layout of WordPress.

From the looks of things, someone has probably hacked your site.

I recommend you:


I did some reverse-engineering on that JavaScript you linked to, and you have been hacked. It's a compression script that uncompresses itself and calls window.eval() to execute its package.

The code adds a hidden iframe that loads content from a bad domain into your site. I'm not going to post the full details of the hack here, but it's pretty bad.

In addition to reinstalling WordPress, I also highly recommend you change all of your server passwords:

  • FTP
  • SSH
  • MySql

You might also want to work with a company like Sucuri - they specialize in malware protection and removal.

  • 1
    I've seen index.php in root get hacked which will cause every front-end page to be affected, regardless of themes of plugins. Reinstalling WP should fix that. Jun 22, 2012 at 20:20
  • That was my fear as well.
    – ashes999
    Jun 22, 2012 at 20:20
  • 1
    Here is that code unobfuscated: gist.github.com/2975029, just in case you were curious.
    – Andy Adams
    Jun 22, 2012 at 20:35
  • I didn't post the code because I didn't want anyone accidentally following the links in it ... but whatever :-)
    – EAMann
    Jun 22, 2012 at 20:40
  • I'm glad Google Chrome protected me. +1 + accepted, cheers, upgrading did the trick
    – ashes999
    Jun 22, 2012 at 21:19

Given what you've described the hack is probably in the index.php in your html root, or in your database stored in your pages or maybe even as an option.. You're going to need to have it cleaned by someone who knows what to look for. A number of us are in that industry.

Attacks are getting to be more creative. The most innovative one I've seen added a harmless looking line that in the end executed the content of an option which included a plugin named Hello Dolly but contained malware. There's some fun stuff out there now and it is not always easy to find it all.

As the codex article says, the quickest, surest way to clean things up is to delete the files, directories and databases and restore from a backup before you had the problem. A manual cleanup takes longer, costs more and is less certain to catch the problem, but if you don't have a recent backup, sometimes it is the only thing to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.