Hi, I have one site that has malware placed into this position:
“<style id=”tdw-css-placeholder”></style>”malware js code here“</head>”
Any ideas how to locate where it is coming from? Tried look everywhere, but can not locate the source where it is.
Hi,
That is the live CSS option -> https://prnt.sc/jTNj90DpZ-L4 Please check there.
I believe that is where the malware code is entered. This means that someone has access to your website, I suggest installing a security plugin as soon as possible, if you haven’t already.
Thank you!
Thank you for suggestion. The live CSS appears to be empty. Is this CSS stored to database or written to file?
The code is inserted after the Live CSS placeholder and before closing head tag.
Any other suggestions where to look?
Anyone?
Hi,
Sorry for the delay. So the code was not there. I see now that the style tag was closed, and the script is after it.
Check in the theme panel here as well -> https://prnt.sc/51gWEk4yt7yX
Also here -> https://prnt.sc/4-jKzkK6iSgg
I suggest also checking in the actual theme header file, which is in the composer plugin here -> https://prnt.sc/JaN9GvXv2aAq
In case you cannot find the code anywhere, I will take a look as well. I suggest sending us an email at contact@tagdiv.com and there please provide a link to the website, admin login, also access to cPanel or similar, even FTP.
Thank you!
