Malware MySQL PHP Security Advisories Technology News Web Applications WordPress

OneTone WordPress Theme Vulnerability

We found many WordPress websites redirecting to malicious URLs and spam domains. After a deep investigation it turned out to be caused by the vulnerable WordPress OneTone theme.

The hack usually takes place in this file: ./wp-content/themes/onetone/includes/theme-functions.php

Beside the above file infection, The Hacker also inject a “eval(atob” malicious javascript malware in WordPress database onetone value within the wp_options table which is responsible for redirecting the website to other suspicious domains such as ischeck[.]xyz

You can check your website security by using this Free website malware scanner

Here is a snippet showing the infection in action as found on an infected website:

[[email protected] ~]$ curl -I https://victim-website[.]net/

HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Keep-Alive: timeout=15
Date: Mon, 11 Apr 2020 19:51:16 GMT
Server: Apache
X-Powered-By: PHP/7.2.16
Location: https://ischeck[.]xyz

As you can notice, The Rank Math SEO is causing a redirect to the malicious domain ischeck which is then redirect to checkandgo and overzoruaon spam domains. Some of the malware domains involved with this specific hack incident:




Signup and Try our malware removal service and let’s clean & protect your websites by using our Website Firewall Protection!

You can check your website security by using this website malware scanner

Website Hacked OR #Blacklisted? Get it Cleaned & Protected Immediately!

Free Scanner:

#Security #wordpress #joomla #magento #drupal #hosting #cpanel #linux #websitesecurity #securedwebsite #hacked

Malware Web Applications WordPress

How to Clean a Hacked WordPress website in 10 simple steps.

Do you think your WordPress has been hacked?

If you think that your WordPress website is hacked and you confirmed this feeling or suspicion using any security plugins or website malware scanners such as our free malware scanner located at then it’s better to ask a professional to clean your website to ensure it’s fully and properly cleaned and SEO remains unaffected. Feel free to take a look at our website malware removal service and

Or feel free to try and follow the below steps if you want to try cleaning it yourself:

How to tell and determine if your website was hacked?

  • Do you see any strange, unrecognized or inappropriate content on your site?
  • Your site started consuming more resources or running slow?
  • Do you see unrecognized users, admin users, FTP or email accounts on your site?
  • Unrecognized files or folders?
  • Customer reporting stolen credit card after purchasing something from your website?
  • Google Chrome, Firefox or other browsers showing a red warning when visiting your website?
  • Do you see any unrecognized ads, popups or redirects to other sites?
  • Your hosting provider suspended your hosting account?
  • If your site is listed as hacked or harmful in Google searches.
  • If you receive a warning from Google webmaster tools or other blacklists.
  • If Google Adwords suspended your running Ads.

You can check your website security by using this free website malware scanner

WordPress Hack repair and malware removal steps:

1- The most important step is to stay calm and focused. Stress is a counterproductive. Take a deep breath and continue reading.

2- It’s very important to generate a full website and database backup.

3- Get a fresh WordPress copy from and start with replacing your WordPress core folders such as:

  • /wp-admin
  • /wp-includes

Most WordPress malware infections are targeting the core files and folders. If the malware/hack issue remains then you need to check and investigate your wp-content folder and all themes and plugins that you use on the website. If it continues, then you need to check your database too. You may also need to check your index.php , wp-config.php and .htaccess file and other common files for any inserted and injected malware.

compare your current live files to the fresh copy you just downloaded using diff Linux command or file comparison tools such as DiffNow or similar tools. Check all reported and infected files and clean or replace it with a clean copy.

4- Update and upgrade WordPress, themes and plugins once you clean and remove the malware/hack. Remove any themes or plugins you don’t use.

5- Review your administrator users for any hidden fake admin users created by the hackers. Make sure to change all of your passwords.

6- Review your plugins and make sure you recognize all of it, Fake plugins installed and placed by hackers are very common. Remove any plugins you don’t use.

7- Once you are done cleaning your website, It’s the time to make a full website backup including database backup.

8- Scan your computer using a good anti-virus software.

9- Check if your website is blacklisted by any search engines or blacklists / anti-virus vendors (Google, Bing, Norton, McAfee, Yandex, etc) and submit reconsideration and reindexing requests whenever needed to make sure your SEO and ranking is not affected by the hack.

10- Stay current and up2date, Keep your wordPress, plugins, themes and everything updated and frequently change your passwords.

Signup now and let’s clean & protect your websites!

You can check your website security by using this free website malware scanner