What is encrypted code in Wordpress themes?

Recently there has been a lot of Buzz among Wordpress users regarding the use for free themes! Some Free themes were found malicious, which included encrypted codes into them. So this has given rise to suspicion in the minds of a theme users against the theme creators.

Some Bloggers don’t give proper credits to the Theme creator and remove their names from the Footer Credits. This has caused a lot of Theme designers to take this unusual step!

For keeping somethings in the Theme as unknown to the Theme user, the designers tend to encrypt it and embed it into the theme. They attach encrypted codes into a separate PHP file in the theme or into some important file in the existing theme. This encrypted code is not understandable to normal users.

What does this Encrypted code do?

This Encrypted code can do many things!

  1. It may cause your theme to work in a weird way.
  2. It may corrupt your database.
  3. It may cause Hacking of Internet accounts of your Blog visitors by your Theme Developer.
  4. It will show Footer Credits of the Theme designer.
  5. It won’t show any observable results.

Removing this Encrypted code may cause your theme to show some annoying behavior. It may cause harm or Destroy your Database. It is also possible that this encrypted code is completely redundant and removing it won’t affect your theme in any way.

Isn’t it shocking? Of course, it is!

I have experienced this before in one of the themes I was testing for this Blog! Let me share my experience with you.

I won’t disclose the name of the Theme, but it was a Freely available theme. It contained a file named RELAY.PHP(Have a look at it here) I was not able to understand anything from this file, So I consulted a good friend of mine named Shashank, who is a Wordpress genius.

He observed the file and told me that the encrypted code in the theme is sending unusual information about my Blog visitors to the Theme developers. It was sending the following information about my Blog visitors to the Theme designer:

  • Server Address
  • Server Software
  • HTTP user agent
  • Server Signature
  • HTTP Referrer
  • Required URL

I was quite irritated upon hearing this and I interrogated more about this topic. Shashank also told me that because of these requests by the encrypted code, I was unnecessary wasting bandwidth. He also told me that removing this file from my theme won’t affect the theme in any way because it did not contain any Wordpress functions that my theme depended upon. So, I removed this Relay.php file from my theme and the Theme worked fine even without it.

I faced such encrypted code yet again in one more Theme! It was placed in the Header.php file, but to my surprise, it was affecting the Footer of the Theme. It contained the copyright information about the Theme designer. Deleting the code caused my Database to be deleted and I was left totally irritated. Thankfully, I was not testing it on this running blog.

How to find this encrypted code in Wordpress themes?

There is a Wordpress Plugin named Theme Authenticity Checker[TAC], which checks all your Uploaded themes for any possible malicious Encrypted codes. Using this plugin is highly recommended!

How to check, What does this Encrypted codes do?

I am specifying two online Decoders or Decryptors whatever you call them! Taree Internet Online Decode Tool and Raxor GzInflate Decryptor. For your general information, remember that these codes generally start with “eval(gzinflate(base64_decode(…“  or  “eval(gzinflate(str_rot13(base64_decode(…”

I think now I have given you enough information about these malicious codes in Wordpress themes. If you need some more, you can always ask in comments!!

Related posts:

Filed Under: Wordpress

Comments are Do Follow! Just follow 2 Simple Rules

Comments (31)

George Serradinho

July 30th, 2009 at 11:24 am    


Wow, I guess the theme developers are really upset or trying to upset other users with this technique.

I use to use free themes until I went to premium themes, it safer and the support is a lot better. I feel sorry for users who think they are using a cool theme, but they are actually sending info to the theme designer.

If I was you, I would mention their theme as there are probably many users using the theme and they could be at risk.

BTW, I have added your post for next weeks Monday roundup. I hope my readers appreciate your post and check their theme if it is for free.

Rohit Sane

July 30th, 2009 at 2:28 pm    


Thanks George for including me in your posts round-up! I hope I will be of help to all those who use free Wordpress themes.

Klaus @ TechPatio

July 31st, 2009 at 3:26 am    


I guess the theme developers can’t really be blamed, it’s far too easy for bloggers to just remove the credits – or copying a paid theme and violate the license.

I’ll be running “Theme Authenticity Checker” on my themes now…

Rohit Sane

July 31st, 2009 at 12:32 pm    


@Klaus You are correct in your way, but just understand the gravity if your Wordpress Database gets deleted and all your efforts for 2-3 years go waste!

blinkky

July 31st, 2009 at 9:46 pm    


I don’t remove any link to theme’s site. It’s someone work and we should appreciate it =)

Swashata

August 1st, 2009 at 3:01 pm    


Nice info! I was wondering if we can decrypt the base64 encryption using PHP! I will do a quick research on this and will comment here if I manage to succeed :)

Amit Banerjee

August 1st, 2009 at 4:04 pm    


Some good points here….

The worst part is if somebody tweaks the CSS and Hides the credit links. This causes Hidden links in your site which harms your rankings.

Stumbled !

Rohit Sane

August 1st, 2009 at 4:20 pm    


Thanks for the Stumble!

Farrhad A

August 2nd, 2009 at 12:10 pm    


I never use free themes, I generally go in for custom or premium themes.

qwertyweb

August 4th, 2009 at 6:17 pm    


i v get2know code ,v can easily remove credits in wp as well as easily convert it into blogger template , true ? i never will try though

Surender Sharma

August 6th, 2009 at 7:52 pm    


Theme designers are too clever.Why they give free theme?
Yes they want something from theme users.
This is really trick to collect free information.

ksbnok

August 9th, 2009 at 5:36 pm    


@Amit generally no designer do this coz its very easy to detect

HOW TO REMOVE IT WITHOUT BREAKING UR THEME:

open the source of the home page by pressing ctrl+u search for the text “footer” or something like “” nearly at the bottom of the source code copy whole code below n place it in footer.php file of ur theme hope it helps :)

Image|http://bit.ly/18ex9r

ksbnok

August 9th, 2009 at 5:39 pm    


It is footer begins in the blank inverted commas

JamesM

August 11th, 2009 at 4:19 pm    


I downloaded and installed what I thought was a nice looking free WP theme, only to find my blog blocked by Google for malicious code! I’m a web developer by trade, but even after removing the theme I had Google problems. In the end I set up a new (non-WP) blog on a new domain and just 301′d all traffic across.

Blogspot to wordpress

August 12th, 2009 at 6:56 pm    


I never liked the funda of coding the footer, though many developer do it for many reasons :
1 Sponsored links
2. User can’t remove the credit..
With encrypted link, users are actually making a chance to give important link juice to some non reliable source..
It’s better to go for theme which is non encrypted else create a custom theme or buy a premium theme…

Ricky

August 13th, 2009 at 6:20 am    


Really nice info, I never faced such kind of problem but it will definitely help me in future. I also don’t remove credits from my footer as i know how much hard work this theme designers are doing.

ravi

August 18th, 2009 at 5:36 am    


hiii
it’s a good article.
but my problem is different i have these codes in all of my theme editor option.
like – theme function,header,footer
i tried your method but its not helping.
pls help me

Rohit Sane

August 18th, 2009 at 2:42 pm    


I would advice to remove each and every part of the encrypted code from your theme. If it is not possible, just change the entire theme cause your blog is also relatively very new. Do, write to us, if you need any further help!

ksbnok

August 18th, 2009 at 4:41 pm    


@ravi which theme u talking about give details

Jacob Yap

August 20th, 2009 at 3:40 pm    


Very glad that I’ve change to premium theme.

Isaac | GoBlogger

September 8th, 2009 at 8:39 am    


Wew! This is a shocking information. I’m glad I use frugal premium theme and I can trust the designer.

Online Stock Investing

September 29th, 2009 at 8:58 pm    


Hey, I read a lot of blogs on a daily basis and for the most part, people lack substance but, I just wanted to make a quick comment to say GREAT blog!…..I”ll be checking in on a regularly now….Keep up the good work! :)

Udegbunam Chukwudi

October 8th, 2009 at 3:08 pm    


The theme of new blog (Patchwork Of Tips.com) has the footer encrypted possibly to keep the creator’s link live. Well I didn’t like it so I decrypted it, added my own links and then re-included his link as it would be unfair to use his theme for free.

Jim Michels

November 23rd, 2009 at 9:42 pm    


I am kind of torn on this, certainly is not cool to put malicious code on a WP Theme but it is also not good form to remove a link and denying someone credit who created a free theme.

Carlos

January 17th, 2010 at 3:17 pm    


I tested this theme with the TAC and were found encrypted code in the file header.php and functions.

I was disappointed because I would love to use it
http://newwpthemes.com/wordpress-theme/praven/comment-page-1/#comment-2870

Rohit Sane

January 17th, 2010 at 4:45 pm    


@Carlos: I would advice not to use this theme. But you just can’t resist yourself, try to remove the code and see weather it works..But it may be risky!

Carlos

January 18th, 2010 at 3:19 am    


I managed to remove all the codes and apparently the theme works normally.

But in the footer.php file there is this warning:

Warning! Your site may stop working if these links are edited or deleted

Rohit Sane

January 18th, 2010 at 8:46 am    


@Carlos: I saw the Codes in the Footer..Those are just normal links and even if you delete them, it won’t cause any harm. The theme designer has just tried to fear you off by saying that your theme wont work properly.

The codes in the header are risky.They may have effects on functions.php and other files.So, take care about that…Footer can be edited without worries..

Carlos

January 18th, 2010 at 2:26 pm    


You’re right, I decided that for the safety of blog is better not to use this theme anymore.

Thanks for the tips!

Tad Crawford

February 21st, 2010 at 10:34 pm    


i am using Wordpress themes with creative common license . Found some unwanted non relevant links in footer and when i try to remove it them is not getting working and showing a message “Theme is created under creative common license and if you remove links it will be no more working”. So is there any way to remove these unwanted footer link ? please do suggest.

Rohit Sane

February 22nd, 2010 at 6:51 am    


@Tad: Is the link code encrypted? Just check out the real meaning of the code using the Decryptors I have linked to.. Else, you can get back to me again!

Leave a reply

Name *

Mail *

Website