functions.php runs on many WordPress requests, making it attractive for redirects, hidden users and script injection. It also contains legitimate theme setup and site-specific customisations. Replacing it blindly can remove important functionality while leaving the attacker’s access untouched.
Preserve, compare and isolate the suspicious block before rebuilding the trusted theme.
Record the installed theme context
Note the active parent and child themes, versions, source and whether administrators have made direct edits. Save the complete theme directories and database before changing code.
Hash the suspicious file and preserve modification time. Check whether the theme editor, SFTP or deployment history explains the change.
Do not open the file through a public web URL or execute copied fragments.
Compare with a trusted package
Obtain the exact parent-theme version from its official source. Compare directory contents offline:
diff -ruN clean-theme/ installed-theme-copy/Review every difference. A child theme is expected to differ; a commercial theme may include generated or licensed files absent from a public sample.
Do not replace the installed theme with a different major version during malware analysis. Update compatibility issues would obscure the cleanup.
Identify how the suspicious code is invoked
Look at surrounding WordPress hooks and conditions. Does the block run on every request, only for logged-out visitors, on a particular referrer or on administration?
Trace external domains, file writes, database changes and dynamic includes without executing them. Search the quarantined site copy for the same distinctive strings.
Encoded text alone is not the complete finding. Determine what the decoded logic would do using static analysis in an isolated environment.
Separate legitimate customisations
List business functions in the current file: custom post types, WooCommerce hooks, shortcodes, enqueues and integrations. Move reviewed custom code into a child theme or small site plugin as appropriate.
Do not paste the entire old file into a clean theme. That can transfer the malicious block and preserve poor maintenance practices.
Test each retained customisation against the current WordPress/PHP version.
Rebuild the theme from trusted sources
In staging or maintenance mode, remove the compromised parent-theme directory and install the verified package. Restore only manually reviewed child-theme files.
Use a patched supported version after compatibility testing. If the theme is abandoned, keeping the infected old version is not a viable long-term repair.
Clear opcode and page caches through supported controls after the clean deployment.
If a PHP worker keeps the previous bytecode in memory, public output can remain infected even when the file on disk is clean. Confirm the host’s normal PHP reload or opcode-cache reset procedure; do not kill processes or restart the whole server without authorisation.
Find how the file was changed
Review WordPress administrators, application passwords, theme-editor access, SFTP/panel users and deployment keys. Check vulnerable plugins and sibling sites.
Search for scheduled tasks or backdoors that rewrite functions.php. Monitor the file after replacement through the prior recurrence window.
Disabling the WordPress file editor can reduce one path, but it does not protect stolen SFTP or hosting credentials.
Verify front-end and business functions
Inspect public HTML for the old injected script or redirect, test logged-out/referrer conditions and review outbound requests. Exercise navigation, forms, language variants and authorised WooCommerce sandbox flows.
Confirm the theme file hash remains stable after cron runs and cache regeneration.
When professional cleanup is safer
Request help when the theme contains extensive undocumented custom work, the file changes again or the code touches checkout. Send the theme/version and suspicious location as text, not credentials or executable attachments.
The repair should preserve legitimate behaviour, rebuild trust in the theme and close the route that modified it.