Title: Two Headers Last modified: August 21, 2016 --- # Two Headers * [NZKid](https://wordpress.org/support/users/nzkid/) * (@nzkid) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/) * Hey Guys, * Can anyone help me on why I have 2 headers up the top of my page? * [http://www.grindtherake.com](http://www.grindtherake.com) * Appreciate all the help! * Thanks! Viewing 15 replies - 1 through 15 (of 16 total) 1 [2](https://wordpress.org/support/topic/two-headers-1/page/2/?output_format=md) [→](https://wordpress.org/support/topic/two-headers-1/page/2/?output_format=md) * [kjodle](https://wordpress.org/support/users/kjodle/) * (@kjodle) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701348) * Are you using a child theme? * Has your site been hacked? Did you really mean to include this code? * `
Apply here payday loans 100% secure
` * Thread Starter [NZKid](https://wordpress.org/support/users/nzkid/) * (@nzkid) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701367) * Hey. I am using Organic theme. * No obviously I didn’t mean to include that code, how did it get there and where is it? * Any idea how to remove the 2 headers? * Thanks! * [kjodle](https://wordpress.org/support/users/kjodle/) * (@kjodle) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701372) * If you didn’t intend to include that code, it’s possible that your site was hacked and the two issues are related. * First thing to try: Deactivate all plugins, refresh browser and server cache, and see if issue goes away. * Second thing to try: Try switching to the default 2012 theme to see if issue goes away. * If not, your site may be hacked. The following will be of some use to you: * [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked) [http://wordpress.org/support/topic/268083#post-1065779](http://wordpress.org/support/topic/268083#post-1065779) [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/) [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/) * Thread Starter [NZKid](https://wordpress.org/support/users/nzkid/) * (@nzkid) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701374) * Where is the code located that you are seeing this link added? I do not seem to be able to find it. * Thanks! * [kjodle](https://wordpress.org/support/users/kjodle/) * (@kjodle) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701377) * Here: * ``` ``` * Thread Starter [NZKid](https://wordpress.org/support/users/nzkid/) * (@nzkid) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701379) * I see. * Strange I can not find it in my Header inside wordpress * [kjodle](https://wordpress.org/support/users/kjodle/) * (@kjodle) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701401) * Use your browser’s “View Source” function. It’s not in the core files. * [velvetcrayon](https://wordpress.org/support/users/velvetcrayon/) * (@velvetcrayon) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701475) * this must be a hack that’s going around, i have it too! ugh. i’m using the “corner” theme and it only shows up when i’m not logged in, if i’m logged in i can’t see it. it’s very annoying. * [velvetcrayon](https://wordpress.org/support/users/velvetcrayon/) * (@velvetcrayon) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701476) * the hack even shows up on the wp-login.php page, currently trying to find it * [velvetcrayon](https://wordpress.org/support/users/velvetcrayon/) * (@velvetcrayon) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701477) * okay, one weird thing about it.. if you goto your login page, don’t type anything and then click “log in”, it goes away. but then when i clear my cache it’s back. hmmm. interesting. * [Tesur Rajan](https://wordpress.org/support/users/tesurrajan/) * (@tesurrajan) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701481) * [@velvetcrayon](https://wordpress.org/support/users/velvetcrayon/) I had the same kind of issue but somehow I managed to remove that spam link. Just paste your header.php code here, so I can tell you how to remove that spammy link. * Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/) * (@jdembowski) * Forum Moderator and Brute Squad * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701482) * No don’t do that. Playing whack-a-mole with spammy links just wastes your time. Honest. * > this must be a hack that’s going around * Maybe but most likely it’s either you are hacked or you’re using a poisoned theme and if that’s the case lose it like a bad infection and delete it. * Seriously, if that’s the case then lose that theme. * > the hack even shows up on the wp-login.php page, currently trying to find it * Ah. You are hacked then. You’ll need to delouse your whole installation, just editing the `header.php` file will 100% NOT work. * You need to start working your way through these resources: [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked) [http://wordpress.org/support/topic/268083#post-1065779](http://wordpress.org/support/topic/268083#post-1065779) [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/) [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/) * Additional Resources: [http://sitecheck.sucuri.net/scanner/](http://sitecheck.sucuri.net/scanner/) [http://www.unmaskparasites.com/](http://www.unmaskparasites.com/) [http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html](http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html) [http://codex.wordpress.org/Hardening_WordPress](http://codex.wordpress.org/Hardening_WordPress) [http://www.studiopress.com/tips/wordpress-site-security.htm](http://www.studiopress.com/tips/wordpress-site-security.htm) * Good luck. * [Andrew Nevins](https://wordpress.org/support/users/anevins/) * (@anevins) * WCLDN 2018 Contributor | Volunteer support * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701483) * Sorry, removing the link is only going to fool you into thinking the issue is resolved because you can no longer see it. * You need to start working your way through the resources Jan pointed out. * Please note that if you have been hacked, you have a serious problem on your hands and it’s not worth using shortcut answers. If in doubt, consider [hiring someone](http://jobs.wordpress.net). * Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/) * (@jdembowski) * Forum Moderator and Brute Squad * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701484) * HA! I beat Andrew to the reply! * _*Drinks more coffee*_ * [@velvetcrayon](https://wordpress.org/support/users/velvetcrayon/) sorry for the side conversation 😉 but the short of it is please check your installation. We think you’re hacked. * [JRGould](https://wordpress.org/support/users/jrgould/) * (@jrgould) * [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/#post-3701520) * I’ve had a client blog hacked by this same exploit – took me quite a while to find it because I was searching the entire file structure for the tell-tale ` eval` or `base64_decode` functions that these sorts of hacks utilize. Turns out this one was using `strrev` to hide itself from just those sorts of broad-stroke searches. * In my site it was actually inserted first thing into functions.php – but if you want to search for it just try searching for `strrev` or `)lave` and you should suss out the injected code. * Obviously this only solves the code injection, not how it got there – so make sure to update wordpress and change all of your passwords. * —edit— * This hack also appears to add an option to your database – for me the option_name was `{options_names}` – I found this by de-obfuscating the injected code and tracing through it really quick to check for any other traces it may have left in my install. Viewing 15 replies - 1 through 15 (of 16 total) 1 [2](https://wordpress.org/support/topic/two-headers-1/page/2/?output_format=md) [→](https://wordpress.org/support/topic/two-headers-1/page/2/?output_format=md) The topic ‘Two Headers’ is closed to new replies. * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 16 replies * 7 participants * Last reply from: [Andrew Nevins](https://wordpress.org/support/users/anevins/) * Last activity: [13 years, 1 month ago](https://wordpress.org/support/topic/two-headers-1/page/2/#post-3701521) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics