Unknown lines added to site's HTML and PHP, need to find them fast

sQL injection is very classic, they might have run a select users query and put admin info into wp-postmeta tables. delete the plugin then whichever one wasnt updated. or drop table..... no its not something that always happens...

Steps: 1) Enter database via phpmyadmin 2) Get wp_options, check all 3) Check wp_postmeta, see if there are foreign meta_keys 4) FTP logs (in hosting panel) 5) post_content field in wp_posts table — if there are many posts and it's fine or if there are script commands delete 6) Disable all plugins and themes 7) Upgrade WordPress

I read you saying you're losing control to your computer... seems like you're experiencing it very dramatically. SQL injection is a simple thing if you don't sanitize queries your database gets compromised too. Investigate 'which plugin didn't I update' and it's done.

I have a testing method: restore from full backup in WordPress staging environment, update plugins and themes, then check if it's still there. If it's not in staging, it's in the file system, if it is, it's in the database. Work accordingly depending on which route you want to take.

I didn't understand the problem very well but... what is a database? What is FTP? Do I need to learn MySQL soon to solve this? Or will someone definitely help?

There's a common mistake people make when doing this. If you don't write this down from the start it leads to arguments later.

If you post the result here, it will help others too.

This thread is archived.

the answer above hits the nail on the head. start with a small trial; don't commit to everything at once.

Sorry, but this doesn't apply in every case. Payment information changes are never verified through the channel they came from.

Quick summary for newcomers: When you try to change everything at once nothing settles.

That's all sorry if I went on too long.

Let me clarify the technical side. If it's your first time, start small; scaling comes later.

Hope this helps.

I'm in the same situation, that's why I'm asking. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

This is my opinion, I'm not claiming it's absolute truth.

I'm writing this so you don't make the same mistake. The harder it is to reverse a decision, the slower you should make it.

Forgotten test environments are more often the entry point than live systems. If I were you I'd go this route.

There is something to watch out for. Most incidents start with a leaked password, not a vulnerability.

Just leaving this note, it might be useful.

You're right. The answer varies greatly by industry; there is no one-size-fits-all rule.

Most time waste accumulates in tasks waiting for approval.

You're right. When you try to change everything at once, nothing settles.

Hope this helps.

i went through the same thing and btw just because everyone does it doesn't mean it's right.

having backups accessible on the same network and with the same identity makes them part of the target. proven by experience.

I agree. If permission and scope aren't in writing, don't start that test.

Most incidents start with a leaked password, not a vulnerability. Hope this helps.