Cryptojacking Scripts on WordPress: Detect & Remove Them

Cryptojacking is an insidious form of cybercrime where malicious actors clandestinely use your website’s resources to mine cryptocurrency without your users’ consent. This often involves injecting JavaScript-based mining scripts, historically exemplified by services like Coinhive, directly into your WordPress site. The result? Slowed-down websites, increased server load, and a degraded user experience, all while silently enriching an attacker. Detecting and removing cryptojacking WordPress infections is crucial for maintaining site integrity and performance.

Understanding Cryptojacking Tactics on WordPress

Cryptojacking scripts typically operate by leveraging your visitors’ CPU cycles while they browse your site. While Coinhive is long defunct, the underlying methodology persists with new, albeit less-known, services and self-hosted mining scripts. Attackers commonly inject these scripts:

Directly into theme files (e.g., functions.php, header.php, footer.php).
Via compromised plugins that have been modified or backdoored.
Through database injections, where script tags are added to post content, page content, or even WordPress options.
By altering .htaccess files to redirect or inject code.
Using malicious advertisements or third-party scripts that load their own cryptojackers.

The goal is always the same: exploit your visitors’ computing power. This often leads to abnormal CPU usage warnings on user devices, high bounce rates, and a significant drop in site performance.

Tell-Tale Signs of Cryptojacking on Your WordPress Site

Spotting a cryptojacking infection early can mitigate its impact. Look for these common indicators:

Performance Degradation: Your WordPress site loads significantly slower than usual, or pages become unresponsive.
High CPU Usage: Your web hosting control panel (cPanel, Plesk, etc.) reports unusually high CPU consumption, even during off-peak hours.
Visitor Complaints: Users report their devices slowing down dramatically, fans spinning loudly, or battery draining quickly when visiting your site.
Unexpected JavaScript in Source Code: When viewing your site’s source code (right-click -> ‘View Page Source’ or ‘Inspect Element’), you might find unfamiliar or obfuscated JavaScript files or inline script tags in the <head> or just before the closing </body> tag.
Suspicious Network Requests: Using browser developer tools (F12, ‘Network’ tab), you may see ongoing requests to cryptocurrency mining pools or unfamiliar domains.

Step-by-Step Cryptojacking Detection and Removal

1. Initial Scan and Backup

Before any changes, perform a full backup of your WordPress files and database. Then, use a reputable security plugin like Wordfence or Sucuri Scanner to perform a comprehensive scan. While these tools are good, manual inspection is often necessary for stealthy cryptojackers.

2. Manual Code Inspection for Cryptojacking WordPress Scripts

Access your WordPress files via SFTP/cPanel File Manager and examine these critical areas:

Theme Files: Pay close attention to wp-content/themes/your-theme/header.php, footer.php, and functions.php. Look for suspicious <script> tags, especially those loading external resources or obfuscated code.
Plugin Files: While harder to manually check every plugin, review recently updated or installed plugins, particularly those from unverified sources. Look for modified timestamps.
wp-config.php: Ensure this file hasn’t been modified to include malicious code or external includes.
.htaccess: Check the root .htaccess file for unexpected rewrite rules or directives that might inject scripts or redirect traffic.

# Example of suspicious .htaccess rule
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTP_USER_AGENT} !(googlebot|bingbot|yandexbot|msnbot)
RewriteRule /* /mining-script.js [L]
</IfModule>

3. Database Inspection for Injected Scripts

Cryptojackers can hide scripts directly in your database. Use phpMyAdmin or a similar tool to inspect tables:

wp_posts: Search the post_content column for <script> tags or known cryptojacking domains (e.g., historical Coinhive domains, or any odd .js includes).
wp_options: Check options like siteurl, home, and other theme/plugin options for unexpected code injection.

-- SQL query to find script tags in post content
SELECT ID, post_title, post_content FROM wp_posts
WHERE post_content LIKE '%<script%>%' OR post_content LIKE '%Coinhive%';

-- SQL query to find suspicious patterns in wp_options
SELECT option_name, option_value FROM wp_options
WHERE option_value LIKE '%<script%>%' OR option_value LIKE '%eval(%>%');

4. Check for External JavaScript Includes and Malicious User Agents

Look for scripts loaded from unusual domains. Sometimes, the malicious script is not directly in your files but rather loaded from an external source via an injected <script src="malicious-domain.com/miner.js"></script> tag.

Monitor your server access logs (access_log) for unusual user agents or repeated requests to suspicious URLs that might indicate a botnet or mining activity.

5. Secure Your WordPress Installation

After removal, take steps to prevent reinfection:

Update WordPress core, themes, and plugins to their latest versions.
Change all WordPress user passwords, especially for administrators.
Remove any unused themes or plugins.
Implement strong security headers (e.g., Content Security Policy) to restrict script execution.
If you suspect a compromised host, contact your web hosting provider.

Prevention: Hardening Against Cryptojacking

Proactive measures are your best defense:

Keep Everything Updated: This is the golden rule of WordPress security.
Use Reputable Sources: Only download themes and plugins from the official WordPress repository or trusted developers.
Strong Passwords & Two-Factor Authentication: Prevent brute-force attacks.
Regular Backups: Essential for quick recovery.
Security Scanning: Implement a good security plugin for continuous monitoring.
Principle of Least Privilege: Limit user roles and file permissions.

Cryptojacking Detection & Removal Checklist

Full Backup: Create a complete site and database backup.
Scan: Run a full scan with a reputable WordPress security plugin.
Inspect Theme Files: Check header.php, footer.php, functions.php for suspicious scripts.
Inspect Core Files: Verify wp-config.php and .htaccess.
Database Scan: Search wp_posts and wp_options for injected script tags.
Browser Dev Tools: Look for unexpected network requests and high CPU usage on the client side.
Clean & Restore: Remove malicious code fragments or restore from a clean backup.
Post-Cleanup Scan: Re-scan to confirm eradication.
Harden Security: Update all components, change passwords, and review user roles.

FAQ: Cryptojacking WordPress

How can I tell if my visitors are being cryptojacked?

Ask visitors if their computers slow down or if fan noise increases significantly while on your site. Use browser developer tools (F12 -> Performance tab) to monitor CPU usage when loading your site. High, sustained CPU usage (above 50% for simple pages) points to a problem, especially if accompanied by unfamiliar network requests.

Can a security plugin fully protect against cryptojacking?

While security plugins like Wordfence or Sucuri perform excellent scans and offer firewall protection, cryptojacking scripts can sometimes be obfuscated or deeply embedded, making them hard for automated scanners to identify. Manual code review and database inspection are often necessary for complete eradication. Furthermore, a plugin cannot prevent infection if the initial compromise was due to weak credentials or unpatched vulnerabilities exploited before the plugin’s firewall could act effectively.

What should I do if I find cryptojacking code but can’t remove it?

If you’re struggling to pinpoint or remove the malicious code, it’s safer to restore your site from a clean backup (before the infection occurred). If no clean backup is available, suspend your site to prevent further harm to visitors and seek professional help. MalwareRemoveExpert.net offers comprehensive WordPress malware removal services, including the precise detection and surgical removal of even the most stubborn cryptojacking scripts without damaging your legitimate content.

Protecting your WordPress site from cryptojacking is an ongoing battle. By understanding the tactics, knowing the signs, and implementing a robust security strategy, you can defend your users and your site’s reputation. If you suspect your site is compromised or need expert assistance, don’t hesitate to contact MalwareRemoveExpert.net for professional WordPress malware cleanup and security hardening.