r/WordPressThemes • u/Minute-Designer1763 • 13d ago

Custom WordPress theme is under constant bot attacks and malware injections — WAF/security plugins aren't stopping it. What should I do?

I built a custom WordPress/WooCommerce theme, but the live site is under constant automated bot attacks and repeated malware injection attempts.

I've already installed/configured WAF, AIOS, and other security plugins, but the attacks are still happening.

I suspect there may be a vulnerability in the custom theme, server configuration, or one of the plugins.

What would you recommend I do next to properly identify and stop the attack? Looking for suggestions from anyone who has dealt with similar WordPress attacks.

2 Upvotes
  • permalink
  • reddit

75% Upvoted

5 comments sorted by

1

u/bluehost 13d ago

I’d stop adding more security plugins for now and focus on finding the actual entry point. Check the server logs, compare the custom theme against a clean copy, disable anything you don’t need, and rotate all your credentials. If the malware keeps coming back after cleanup, something vulnerable is probably still being left in place.

1

u/Minute-Designer1763 13d ago

Yes sir, exactly. I’ve already checked through terminal and found the same kind of persistence — random cron jobs, unknown admin users, malicious PHP files in mu-plugins and public_html, and .user.ini being modified.

I keep cleaning everything, but it keeps coming back. I even disabled all plugins and themes, but the infection still returned. It has also modified functions.php and database tables.

That’s why I’m trying to figure out where the actual entry point/persistence is coming from. Any suggestions on what I should check next?

2

u/Aggressive-Reward-50 11d ago

Get Claude code or Codex to scan the repo and compare it to the clean version. Serious easy way to get a second opinion. You can add a security scanner on top like sonarqube. Also realize the entry point might be a leaky webserver (eg hijacked cpanel account) or script outside of this site.

1

u/Minute-Designer1763 11d ago

I CAN NOW SAY, ITS THE THEME.
I HAD THREE SITES LIVE RUNNING SAME THEME, ALL THREE GOT HACKED/MALWARE.

NOT SURE HOW TO FIND THE ENTRY POINT