WordPress网站出现themeforest.net重定向，求排查来源、解决方法及是否遭入侵

Hey Eric, let's work through this step by step to track down those themeforest.net redirects and get them fixed—no need to jump to hacking conclusions right away, but we’ll cover all bases to be sure.

Since ThemeForest is a major premium theme marketplace, the redirects are often tied to your active theme:

• Dig into your theme’s functions.php file: Search for keywords like themeforest, wp_redirect, or redirect to spot any hardcoded redirect logic.
• Check your theme’s settings panel: Many premium themes include options for "theme validation" or "update checks" that ping ThemeForest. Look for toggles to disable these features, or any suspicious redirect-related settings.
• If you’re using a child theme, double-check its files too—sometimes custom code there can accidentally introduce external redirects.

Plugins are another common culprit for unexpected external requests or redirects:

• Do a quick isolation test: Disable all plugins, then run your Pingdom scan again. If the redirects disappear, re-enable plugins one by one and retest each time to pinpoint the problematic one.
• Focus on high-risk plugins: Cache tools, SEO plugins, security plugins, and any theme-specific add-ons are good places to start.
• Scan plugin files: Use your hosting file manager or an FTP client to search plugin files for themeforest references—this can reveal hidden external calls that trigger redirects.

If the above steps don’t turn up anything, it’s time to check for potential hacking signs:

• Inspect your .htaccess file: Look for unusual RewriteRule entries that redirect traffic to ThemeForest. A standard WordPress .htaccess won’t include these kinds of rules.
• Check wp-config.php: Make sure no malicious code was added here (look for hidden redirect functions or strange include statements).
• Run a security scan: Use a plugin like Wordfence to scan your site for malware, modified core files, or suspicious database entries.
• Audit your database: In phpMyAdmin, check the wp_options table (your prefix might be different) for tampered siteurl/home values, or any other options containing ThemeForest links.

Once you find the source of the redirects:

• If it’s a theme/plugin issue: Either disable the problematic feature, or reinstall a clean, official version of the theme/plugin (always download from trusted sources to avoid hidden code).
• If it’s malicious code: Delete the bad code, restore modified files from a clean backup, then harden your site security—update WordPress core, themes, and plugins, use strong unique passwords, enable two-factor authentication, and consider a security plugin for ongoing monitoring.
• Clear all caches: Wipe server cache, plugin cache, and browser cache, then re-run your Pingdom test to confirm the redirects are gone.

内容的提问来源于stack exchange，提问作者Eric