A popup with threats began to appear on the site, how to find it?

Question

WordPress

Once a month, a pop-up message appears on my website that supposedly the Ministry of Internal Affairs has blocked the phone. Appears only in mobile browsers. To fix the situation, I simply delete the entire wp-includes directory and download it completely from the backup. A month later, the window appears again. Can't find anything in the code.

Where to look and how to calculate the culprit? The feeling that a redirect is happening - in the address bar the domain changes to different sites constantly - mvd-lock.info , mvd tech and other crap),

spoiler

but despite this, the popup seems to be displayed on top of the content of my site:

spoiler

Answer 1

You just won't find it that way.
If the ad block is reanimated by itself, it means you have a shell somewhere on the site.
And you need to look for a shell. It can be both in files and in the database. Or maybe there is a vulnerability in some plugin.
In practice, one of the clients also encountered resuscitation through crowns. Although, of course, such exotic options for advertising firmware are rare.
First, try rolling back to an old backup. Then update the plugins and vp version to the latest, then change the passwords for the admins.
if this does not help, I can help myself, already on a financial basis.

Answer 2

First, you need to tinker with the web inspector - who calls the redirects, from where ... I have experienced when the provider himself introduced the left code into the traffic (such as advertising integration).