How to find out where the worm is registered in WP?

Question

Computer networks

A worm has wound up on the hosting, which, when entering sites from mobile, replaces the URL and gives out the wrong sites that you need.
Previously, almost all sites were in html, now I have put some on wordpress. But two months later, the worm began to replace the address from the mobile on this site as well. How to calculate where he registered?

Answer 1

check
1. pattern. first of all futur.
2. plugins.
nowhere else

Answer 2

Change passwords from billing and from FTP
Perhaps there is a shell on the site, or a hole through which you filled this muck.
Look at the .htaccess file and template files.
Since mobile forwarding can only be done by User-Agent (The most common way).
Also, AI-Bolit would not hurt you
And if possible, give a link to the site
And yet, does it replace everyone or just you?

Answer 3

on one site there was such a trouble, check your computer, check ftp, then look for the script in the template, I had it in the header. You can find it with firebug first.

Answer 4

Change passwords for everything - it's for anyone.
Well, you need to find the worm through Total Commander. Wordpress is such a CMS that has a lot of vulnerabilities due to plugins. Maybe check the plugins.

Answer 5

This virus sits in HTACCESS, or rather not itself, but the result of activity. The virus itself is most likely in the 404.php files and in the languages ​​folder. Look at my previous answers, there are solutions on how to deal with this.

Answer 6

Thanks for answers. How to search for worms through the total? Haven't seen anything like it.
Here is the HTACCESS
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress