PHP Files in Uploads – Encode64’s

  • derickschaefer

    (@derickschaefer)


    16 years, 5 months ago

    When PHP files starting to appear in your Uploads directory, it is generally one indication you’ve been hacked. Encode64 strings in theme footers, WordPress Files, etc can also be an indication. Still, I don’t want to explore the topic as we are doing a little brainstorming.

    Is there any legitimate reason why a hosted wordpress install would have PHP files in the Uploads directory?

    I have seen themes use encode64 strings as part of their licensing. However, I’ve also seen a lot of site hackers use it to redirect Googlebot for example. How common are “legitimate” uses of this?

    Just want to get some input from the community.

The topic ‘PHP Files in Uploads – Encode64’s’ is closed to new replies.