EDITS.WS

Author: Rob Pugh

  • How to Find, Access, and Edit functions.php in WordPress

    If you’re just getting started with WordPress development, one of the most important files you should familiarize yourself with is the functions.php file. There are actually three possible functions.php files that you might use on your WordPress website, and each plays a different role. Knowing where these files live, what their purpose is, and how and when to modify them will help you when troubleshooting issues and give you more control over your site’s functionality.

    In this article, we’ll cover everything you need to know about WordPress functions.php files. You’ll learn what functions.php does and how to find and edit it. We’ll even include a few useful code snippets to try out. 

    You can start at the beginning and read through or jump to a specific section using the table of contents below:

    What is functions.php in WordPress?

    In WordPress, the functions.php file is where vital code lives that determines the way your site works. There are actually at least two functions.php files in every WordPress website — one included with WordPress core and one included with your theme. If you’re using a child theme, you should also have a functions.php in your child theme folder. 

    The functions.php file in WordPress core contains important code that’s required for WordPress to function. You should almost never modify the code in WordPress core’s functions.php file. 

    Your theme’s functions.php file is where all the theme-specific features of your website live — like custom menu locations, widget areas, custom header and footer content and functionality, post excerpt length, and more. 

    Your theme’s functions.php file behaves in much the same way as a WordPress plugin. The difference is that functions.php should be used for code that is theme-specific, while plugins should be used for functionality that will remain even when you switch themes.

    Where is the functions.php file located?

    We’ve talked about what the functions.php file does both in WordPress core and in the theme files, but how do you find the functions.php file? Where is functions.php in WordPress? 

    All of your WordPress files are located in your site’s root directory and in various subfolders. Your root directory is usually named something like public_html or www, but may have a different name. If you aren’t sure where to find your WordPress installation folder on your server, contact your web host.

    Once you’ve found where your WordPress files are located on your server, you can start looking for your functions.php files. We’ve mentioned that there are up to three locations for functions.php: WordPress core, your theme folder, and your child theme folder. In this section we’ll go over where to find each one. 

    Where is functions.php in WordPress core?

    If you’re looking for the location of functions.php in WordPress core, you’ll find it in the wp-includes folder of your WordPress installation. 

    finding the functions.php file in wp-includes

    While you should never edit functions.php in WordPress core, you may find yourself needing to inspect it for one reason or another. The most likely scenario for poking around in functions.php in WordPress core is if you suspect that malware has been injected into it. 

    Before even opening functions.php, you should make a backup of your WordPress site in case you accidentally make a change to the file that causes a critical error. If you find that functions.php has been corrupted or hacked, chances are you may have other areas of WordPress that are affected. The best thing to do is simply replace WordPress with a fresh installation, rather than trying to remove all the offending scripts one-by-one.

    Where is functions.php in my WordPress theme folder?

    Your theme’s functions.php file is located in the main directory of your theme folder: wp-content → themes → yourtheme.

    finding the functions.php file in the theme folder

    Where is functions.php in the WordPress child theme folder?

    The WordPress child theme functions.php file is located in the main directory of your child theme folder: wp-content → themes → yourtheme-child.

    finding the child theme functions.php file

    How do I access functions.php?

    Knowing where functions.php lives is only half the job. Now comes the question of how to access functions.php in WordPress. While the functions.php file in WordPress core can only be accessed through secure file transfer protocol (SFTP) or through cPanel, your theme and child theme functions.php files can also be accessed in the WordPress Theme File Editor. 

    Accessing functions.php in the WordPress Theme File Editor

    If you need to access your theme or child theme’s functions.php file, you can do so directly from the WordPress Theme File Editor. In your WordPress dashboard, go to Appearance → Theme File Editor.

    You’ll be taken to the Edit Themes page. From here, under the dropdown next to Select theme to edit, choose your theme and click Select. You’ll see a list of files available to edit under the Theme Files column at the far right of your screen. Click functions.php to open the file.

    finding the functions.php file

    If you’re in your parent theme’s functions.php file, you’ll see a warning notice on the bottom of the screen above the Update File button that says, “Caution: This is a file in your current parent theme.” 

    Note: If you’re not the theme developer, you should make your changes in your child theme’s functions.php file to avoid having your edits overwritten in future theme updates.

    Accessing functions.php via SFTP

    Step 1: Install your SFTP client. If you don’t have an SFTP client already, you’ll need to download one. There are some great free and premium options out there, including: 

    Application System Free or Premium
    WinSCP Windows Free
    Filezilla  Windows, Mac, Linux Free and premium options
    Cyberduck Windows, Mac Free
    Transmit Mac Premium

    In this example, we’ll be using Filezilla. Other SFTP clients should work in a similar fashion.

    Step 2: Retrieve your SFTP credentials. To log into your server via SFTP you’ll need the following details:

    • Host (your server’s IP address or url)
    • SFTP username
    • Password
    • Port number

    These details can usually be found in your hosting control panel. This information might be generated for you or your host may prompt you to create an SFTP username and password. If you don’t know where to find these credentials or have trouble figuring out how to create them, search your host’s help documentation for instructions or contact their support team. 

    Step 3: Enter your SFTP credentials.

    Enter your host’s IP address or url, your SFTP username, password, and the port number (usually 22 or 2222, but some hosts may use a different port).

    entering sftp credentials in Filezilla

    Note: You might get a ‘host key unknown’ alert if your SFTP client uses trust on first use (TOFU) authentication. Check ‘Always trust this host, add this key to the cache’ if you plan on using your SFTP client to access the site again. Click OK to proceed.

    unknown host key message in filezilla

    Step 4: Navigate to your website’s root directory.

    Once you’ve logged in, you’ll see two file trees displayed at the button of your screen  — one on the left and one on the right. The right side lists the directories on your web server (remote). The left side lists the directories on your computer (local). 

    Your root directory is usually in a folder labeled www or public_html, but it might use a different name. If you aren’t sure what folder to look in, ask your hosting provider. You’ll know you’re in the correct folder if you see the wp-admin, wp-content, and wp-includes folders near the top of your file list.

    finding the public_html folder in Filezilla

    Step 5: Navigate to functions.php in WordPress core, your parent theme, or child theme. If you’re looking for functions.php in WordPress core, you’ll navigate to the wp-includes folder.

    If you’re looking for functions.php in your theme directory, you’ll navigate to wp-content → themes → yourtheme.

    To find your child theme’s functions.php file, go to wp-content → themes → yourtheme-child.

    Step 6: Download functions.php. Now that you know where functions.php is located and have accessed it, you might want to inspect or edit the file. Before you can do that, you’ll need to download it. Right click on your functions.php file and select Download. Your file will be downloaded to your local machine.

    downloading the functions.php file from Filezilla

    Accessing functions.php in cPanel

    If your host uses cPanel, you can access functions.php through its file manager. If you don’t know how to find cPanel in your host’s dashboard, contact their customer support for help. 

    Step 1: Open cPanel’s File Manager. Once you’re in cPanel, navigate to the Files section and click on File Manager.

    Step 2: Open your website’s root folder. The root folder is commonly called www or public_html, but it may have another name. Root folder naming conventions differ on some hosts, so if you aren’t sure what folder to look in, ask your hosting provider. 

    You’ll know you’re in the correct folder if you see the wp-admin, wp-content, and wp-includes folders near the top of your file list.

    Step 3: Find and download functions.php. The functions.php file for WordPress core is located in your wp-includes folder. 

    Your theme’s functions.php file is located in wp-content → themes → yourtheme.

    If you’re looking for your child theme’s functions.php file, you can find it in wp-content → themes → yourtheme-child.

    When you’ve found the functions.php file you’re looking for, right click on functions.php and click Download, or single-click functions.php and then click the Download option from the top menu.

    downloading the functions.php file from cpanel

    If you rename your file when you save it, make sure to name it back to functions.php before re-uploading it. And before you make changes to and overwrite functions.php, back up your WordPress site

    When should I edit functions.php in WordPress?

    Before we dive in to how to edit functions.php, we should talk about if and when you should edit it. There are many reasons you might want to edit PHP code in WordPress, but adding that code to your functions.php file is not always the best option and should only be done under certain circumstances, which we’ll discuss below.

    When to edit functions.php in WordPress core

    Never. You shouldn’t edit functions.php in WordPress core. At most, you might replace it if you find that it’s been corrupted, but deleting or adding code to WordPress core functions.php is likely to break your site. So, you can open it, inspect it, replace it with a fresh copy if you need to, but don’t mess around on any live websites.

    When to edit functions.php in your theme

    When it comes to your theme’s functions.php file, you may or may not need to edit it. If you’re creating your own theme, you’ll most certainly want to add some custom code to functions.php. Just about every theme has code in its functions.php file that gives it a unique set of features and capabilities. Besides your stylesheets, these functions are a huge part of what makes one theme different from another.

    If you’re adding code to your theme’s functions.php file that isn’t specific to your theme and could be used independently of your theme, consider making it a plugin instead. This way you can use that feature across multiple themes and even submit it to the WordPress.org plugin library where it might benefit other WordPress users. 

    Before creating your plugin, check the plugin library to make sure what you’re creating doesn’t already exist. If a quality solution exists already, you might want to save your development energy for a different custom feature on your site.

    When to edit functions.php in your child theme

    If you’re using a theme from a developer, and want to modify the functions.php file, you should always use a child theme to make those changes. When theme developers issue a new version of their theme and you update to the latest one, your current theme is overwritten by the new files — including functions.php

    Child themes are unaffected by parent theme updates, so you’ll retain all your custom code if you make changes in a child theme’s functions.php file.

    Before adding code, consider whether using a plugin would be a better solution. Is the code you’re adding specific to your theme? Edit your child theme’s functions.php file. Is the code you’re adding something you want to still have if you change themes in the future (e.g. Google Analytics tracking code or Facebook pixel)? Use a plugin.

    How to edit functions.php in WordPress

    You should always take steps to protect your site from any mistakes you might make while editing functions.php. So before you start making edits, back up your site and consider creating a staging site to test them first. This way your live site is not disrupted if you accidentally add some code to functions.php that causes major issues or — even worse — crashes your site completely.

    Now that you’ve backed up your site, you can move on to editing your functions.php file.

    How to edit functions.php in the WordPress Theme File Editor

    Editing functions.php in the WordPress Theme File Editor is a little risky. If you’re using this tool because you don’t have access to cPanel or SFTP, then you’ll be in a pretty bad situation if your edits cause a fatal error that prevents you from accessing your WordPress dashboard. 

    If you want to edit functions.php in the Theme File Editor, make sure that you have direct access to the server and your backups so you can restore your backup file quickly.

    You can find the WordPress Theme File Editor under Appearance → Theme File Editor in your WordPress admin panel

    You’ll be taken to the Edit Themes screen, where you should select your child theme, then select the functions.php file from the Theme Files column at the right of your screen.

    editing the functions.php file in the theme file editoor

    If you’ve selected the parent theme instead, you’ll see a warning at the bottom of your screen that says, “Caution: This is a file in your current parent theme.” You don’t want to make edits to your parent theme’s functions.php file because your changes will be overwritten the next time you update your theme.

    If you see functions in your file that you don’t understand, WordPress includes a handy documentation lookup feature just above the Update File button. Click the dropdown and search for the function name that you want to learn more about and click Look Up. You’ll be directed to the WordPress.org documentation for that function. 

    When you’re done with your changes, click Update File. Check the front and back end of your site to make sure everything is still working as intended. If you encounter a fatal error and need to restore functions.php from your backup, you can do that in cPanel or via SFTP.

    Editing functions.php with a text editor

    The best way to edit functions.php is in your code editing software of choice. Since you’re editing a copy that’s offline on your local computer, you don’t have to be connected to the internet to work on your file. You’ll also have more control over when you commit your changes to your live site. 

    You can edit your code whenever you like and upload your changes at a time when your website normally gets the least traffic. That way, if there are any issues, the fewest number of visitors will be impacted.

    Step 1: Open functions.php in your text editor. If you aren’t familiar with using a text editor, there are several free options to choose from. 

    Free source code and plain text editors:

    Application System
    Notepad++ Windows
    Atom.io Windows, Mac, Linux
    Sublime Windows, Mac, Linux
    TextEdit
    *make sure you’re in plain text mode
    Mac (default application)
    Notepad Windows (default application)

    Step 2: Edit functions.php and save to your local machine. Your display may look different depending on what program you use to edit your functions.php file. This is what PHP code looks like in atom.io:

    editing functions.php in atom.io

    Add or change whatever information you need to, then save your file. 

    Step 3: Log into your web server via SFTP or cPanel. Navigate to your theme or child theme folder and find the functions.php file.

    Step 4: Change the file name of functions.php on your web server. In case your edited version contains errors, you don’t want to overwrite your original functions.php file. You’ve made a backup, of course, but instead of having to pull the functions.php file from your backup, you’ll have your original file on-hand. 

    You want to be able to restore the functions.php file quickly if something goes wrong, so renaming it to something like ‘functions-orginal.php’ will make sure that the contents of the original file are preserved on your server.

    renaming the functions.php file

    Step 5: Upload functions.php from your local machine to your webserver. Using SFTP or cPanel, upload your functions.php file to your theme or child theme’s main directory.

    Step 6: Visit your website to make sure it’s working correctly. Once you’ve uploaded your functions.php file, you should check to make sure that everything is working on your site. Visit the front end and log in to the WordPress dashboard to make sure everything is accessible and displays and functions correctly. 

    Step 7: Delete the old, renamed functions.php file. Once you’ve established that your site is working properly, you can delete functions-original.php (or whatever you renamed it to). If you find an issue down the road, you should still have your functions.php file from the backup you made.

    Editing functions.php directly in cPanel

    If you don’t have or don’t want to use a source code editor, you can edit functions.php directly in cPanel (if your host uses cPanel). Like editing in the WordPress Theme File Editor, it’s a little more risky than working on your local machine. If your internet connection is disrupted while you’re editing, you could lose your changes. You also run the risk of potentially overwriting your original functions.php file.

    Step 1: Find functions.php in cPanel. In cPanel, click on File Manager.

    Navigate to your root folder (usually public_html or www, but it could have a different name).

    Step 2: Make a copy of functions.php. In your File Manager main menu, click + Folder to add a new folder. You’ll want to make a copy of your functions.php file and save it here as a backup.

    Name your new folder something easy to identify like ‘backup functions’ so you can easily find it later. Click Create New Folder.

    making a cpanel backup of the functions.php file

    Step 3: Find functions.php in your theme or child theme folder and copy it to the backup folder. In your theme or child theme folder, scroll down to functions.php and right click on the file name. Select Copy.

    copying the functions.php file in cpanel

    A dialog box will appear asking you to enter the path you want to copy the file to. The path to the folder you’re currently in will be pre-populated, so if the file path to your backup folder differs from what you see, type in the correct path. Click Copy File(s).

    Step 4: Navigate back to functions.php in the theme or child theme directory. Now that you have a backup, you can go back to the functions.php file in the theme or child theme directory and start editing. 

    Right click on functions.php, then click Edit.

    Step 5: Edit functions.php. You should now see the contents of your functions.php file on your screen. It should look something like this: 

    example of the functions.php file in cpanel

    Add or change whatever information you need, then save your file. 

    Using a plugin to add functions to your WordPress site

    Instead of directly modifying the functions.php file, you can use a plugin like Code Snippets to add functions to your website. If you need to add a fair number of functions to your site, it can be easy to lose track of which functions you still need and which you don’t. 

    Code Snippets provides a graphical user interface (GUI) for managing your blocks of PHP code. You can add descriptions so that you know what the code is supposed to do, and turn blocks of code on and off, much like activating and deactivating a plugin.

    Since you’re not making changes to functions.php, it’s a much safer method of adding PHP functions to your WordPress site.

    How to protect functions.php from security exploits

    The functions.php file is often a target of hackers, so keeping it safe should be a high priority. Take the following steps to help you secure your functions.php file:

    1. Install a security plugin

    By using a security plugin, you’ll enjoy advanced protection from hackers across multiple areas of your site. 

    Jetpack Security is an inexpensive option that helps keep your site safe from malicious attacks. It includes malware scanning and one-click fixes, brute force attack protection, downtime monitoring, an activity log so you know if and when your site was hacked, and login protection via two-factor authentication (2FA).

    Jetpack homepage messaging

    Jetpack Security also monitors your site for any changes to core WordPress files, outdated or insecure plugins, and other vulnerabilities so that you can catch them before a hacker finds them and takes advantage. 

    Plus, it provides real-time WordPress backups so you can quickly restore a clean version if anything goes wrong — even if you can’t log into your site.

    2. Deny access to WordPress core functions.php via the .htaccess file

    If your website is hosted on an Apache server, you can use an .htaccess file to help protect your WordPress core functions.php file by blocking access to the entire wp-includes folder.

    Step 1: Download .htaccess

    Using SFTP or cPanel, navigate to the root folder of your website. Right click on .htaccess and select Download to download the file to your local computer.

    Step 2: Add code to block access to the wp-includes folder

    In a source code or plain text editor, open .htaccess and add the following code:

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
    </IfModule>

    Save your file. Make sure that your editor program does not include a file extension. If you’re using Notepad++ or Text Edit, it may add a .txt file extension. The file should simply be named ‘.htaccess.’ 

    Step 3: Upload the edited .htaccess back to the root folder

    Upload your edited .htaccess file back to your website’s root folder. You’ll be asked if you want to overwrite the existing file. Click Ok.

    Now your .htaccess file should block external access to any files in your wp-includes folder, including functions.php.

    3. Deny access to functions.php using functions.php

    You can block direct access to your functions.php file by adding the following code snippet directly to functions.php.

    if (!empty($_SERVER[‘SCRIPT_FILENAME’]) && ‘functions.php’ ==
    basename($_SERVER[‘SCRIPT_FILENAME’]))
    {
    die (‘Access denied!’);
    }

    4. Hide functions.php outside of the root directory

    Hackers know the default location of all standard WordPress files. Changing the location of sensitive files to a restricted access folder outside the root directory can keep it out of reach of hackers. This process is a little more involved than just adding some code to your .htaccess file, but it’s worth the extra effort for the additional layer of protection to your website. 

    In just a few steps, you can secure functions.php outside of the root folder.

    Step 1 : Download your current functions.php file

    If you’re moving your theme’s functions.php file, you’ll find it under wp-content → themes → yourtheme. Your child theme’s file will be in wp-content → themes → yourtheme-child.

    Once you’ve found your functions.php file, download it to your computer via SFTP or cPanel.

    Step 2 : Create a new directory outside of the root folder

    Navigate outside of your root directory to the next file folder level up. You should see the name of your root folder as well as several other folders. In this directory, right click and select Create directory.

    creating a directory in Filezilla

    Give your directory a name that’s easy to remember as the location of your functions.php file.

    Step 3: Upload functions.php to your new folder

    Upload the functions.php file you downloaded earlier into your new folder via SFTP or cPanel. 

    uploading the functions.php file

    Check your new folder and functions.php file permissions and make sure they’re set to 600.

    setting permissions for the functions.php file

    Step 4 : Point WordPress to the new functions.php file

    You should have a functions.php file in your new directory as well as the original functions.php file that is still in your theme folder. In order for WordPress to find and use the correct file, you’ll want to delete all the information in your theme file’s functions.php file and the following code snippet:

    <?php
    include('/home3/usr/securefunctions/functions.php');
    ?>

    Note: Your file path will look different, as you’ll be using your server’s directory names.

    In cPanel, you can open the root directory’s functions.php file and edit it directly or you can edit the copy you downloaded to your local machine earlier using a source code editor. For this example, we’ve edited the copy we downloaded earlier using Atom.io.

    Save your funtions.php file and upload it back to your theme directory.

    returning the functions.php file via ftp

    You’ll be asked if you want to overwrite the file. Click Ok.

    Now, WordPress should reference your new functions.php file in its secure location outside of the root folder.

    4. Change the name of your functions.php file

    Changing the name of your functions.php file is another step you can take to keep it safe from hackers. You’ll need to host this file outside of your root folder, so if you’ve followed the process in Hide functions.php outside of the root directory, you’ll only need to take a few additional steps.

    Step 1: In your secure directory outside the root folder, change the file name of functions.php

    Go to the functions.php folder hosted outside of your root directory and change the file name to something unique, like ‘keep-out.php’ or ‘these-are-not-the-functions-you-are-looking-for.php’. Okay, that last one’s a little long, but it doesn’t really matter what you call it as long as you include it in the file path in the theme folder copy of functions.php.

    Step 2: Edit the code in functions.php in your root directory to reflect the name change

    Now that you’ve changed the name to something other than functions.php, you’ll need to make sure your theme directory copy of functions.php is pointing to the right file name. 

    Download the root folder copy of functions.php to your local computer and edit it with your text editor. Change the functions.php file name to your new file name, then save your file.

    <?php
    include('/home3/usr/secureconfig/keep-out.php');
    ?>

    Step 3: Upload functions.php back to the theme directory

    You’ll be asked if you want to overwrite the existing file. Click Ok

    Now WordPress should point to your renamed functions file. 

    Additional layers of security for functions.php

    You can add some additional protection to your website as a whole, including your functions.php file, by making similar changes to your wp-config file like renaming it, hosting it outside the root directory, and denying public access.

    If you see suspicious code in your functions.php files and are worried you may have been hacked already, you’ll want to read up on how to detect and remove malware from your WordPress website.

    What code can I add to functions.php in WordPress?

    There are a lot of different code snippets that you can add to your WordPress functions.php file. However, you’re often better served by using a plugin (or writing your own plugin) for many functions. If the code you want to add is specific to your theme, then you can add that PHP code to your child theme’s functions.php file. 

    Below are a handful of useful functions you might insert into your child theme’s functions.php file: 

    Adding a new admin user in functions.php

    If you’ve lost admin access to your WordPress dashboard and can’t recover your username or password via email, you can create a new admin user through your hosting account. Either via SFTP or cPanel, you can download your functions.php file and add the following code to create a new admin user for your site.

    function qode_add_new_admin_account() {
    $user = 'your-username';
    $password = 'your-password';
    $email = 'your-email';
    if ( ! username_exists( $user ) && ! email_exists( $email ) ) {
    $user_id = wp_create_user( $user, $password, $email );
    $user = new WP_User( $user_id );
    $user->set_role( 'administrator' );
    }
    }
    add_action( 'init', 'qode_add_new_admin_account' );

    In the above code, replace ‘your-username’, ‘your-password’, and ‘your-email’ with your own credentials. Save your functions.php file and re-upload it to your theme folder. This will create a new admin user with the username, password, and email address that you’ve assigned in the code. 

    After you’ve uploaded your file, navigate to your site’s login page and use your new username and password to log in. Once your login is successful and you’ve confirmed that you have admin privileges, you should remove the code that you added to create your new admin account from functions.php

    Adding and removing image sizes in functions.php

    When you upload an image to the WordPress Media Library, multiple variations of your image are generated. WordPress has default thumbnail, small, medium, and large sizes that are used in addition to your full size image. Your theme will generally pull the optimal image size for individual parts of your site. 

    If you’re creating your own theme or need to make modifications to a child theme to accommodate additional custom image sizes, you can do so in your functions.php file. 

    Use the following code and change your custom image size name from ‘custom-small-square’ and ‘custom-landscape’ to whatever name you’d like to use. The numbers next to your custom image size name represent the image size in pixels, so enter the pixel values with width first and height second.

    function register_custom_image_sizes() {
    if ( ! current_theme_supports( 'post-thumbnails' ) ) {
    add_theme_support( 'post-thumbnails' );
    }
    add_image_size( 'custom-small-square', 450, 450, true );
    add_image_size( 'custom-landscape', 1000, 600 );
    }
    add_action( 'after_setup_theme', 'register_custom_image_sizes' );

    Keep in mind that additional custom image sizes can weigh down your site and impact load times. If you have some WordPress default image sizes that your theme doesn’t use, you may want to delete and disable those to make room for your custom sizes. 

    If you want to disable WordPress default image sizes, you can place this code snippet into your functions.php file:

    add_filter( 'intermediate_image_sizes_advanced', 'prefix_remove_default_images' );
    // This will remove the small, medium, and large default image sizes. 
    function prefix_remove_default_images( $sizes ) {
     unset( $sizes['small']); // 150px
     unset( $sizes['medium']); // 300px
     unset( $sizes['large']); // 1024px
    
    
     return $sizes;
    }

    If you only need to disable one or two sizes, you can only add those sizes to the code above and delete the code that you don’t need. 

    Use functions.php to allow additional file types in uploads

    WordPress only allows a few different file types to be uploaded in your WordPress dashboard. This is a reasonable security measure, but you might encounter a situation where you need to upload a file type that’s not natively allowed. 

    To add more allowed file types to WordPress, add the following code to your child theme’s functions.php:

    function additional_upload_file_types($mime_types){
    $mime_types['stl''] = 'application/sla';
    $mime_types['stl'] = 'application/vnd.ms-pki.stl';
    $mime_types['stl'] = 'application/x-navistyle';
    return $mime_types;
    }
    add_filter('upload_mimes', 'additional_upload_file_types', 1, 1);

    For the above example, we used the stl file type, which is a CAD file type. It’s an unusual file type to upload to a website outside of certain niche industries, but if your site is for an industrial designer, engineering firm, or even an orthodontics lab, you might find the ability to upload STL files really useful. 

    You can replace the $mime_type variable with whatever file extension suits the needs of your website. You’ll also need to include the media type and subtype after that (e.g. ‘application/sla’ or ‘image/octet-stream’). Here’s a complete list of mime types that you can refer to. 

    Frequently asked questions about editing the functions.php file in WordPress

    We’ve covered what the functions.php file is, how to find functions.php, how to access it, how to edit it, and a few code snippets you can add to your functions.php file. We’ll wrap things up with a few helpful answers to frequently asked questions. 

    Do I really need to use a child theme to edit functions.php?

    The short answer? Yes.

    If you’re a theme developer, you’ll definitely want to add your theme-specific functions directly to your theme’s functions.php file. If you’re modifying a theme from another developer that will get regular updates, however, you’ll absolutely want to use functions.php within a child theme. 

    Most theme developers will periodically make updates to their themes for security and performance reasons, or to add new features. If you change the parent theme’s functions.php file, those changes will all be overwritten when you update to your theme’s latest version. All your hard work and customizations — poof! Gone. 

    Child themes aren’t touched when the parent theme updates, so if you make changes to your child theme’s functions.php file, your changes will be preserved any time you update your parent theme.

    I edited functions.php and now I don’t have access to my WordPress dashboard. Help! 

    In the unfortunate event that you edited the functions.php file and caused a critical error on your site that kept you from accessing the WordPress dashboard, don’t worry — all is not lost!

    There are a few things you can do to restore access to your site. You can edit functions.php via SFTP and a text editor or directly in cPanel if you know which bit of code caused the issue. Alternatively, you can restore functions.php from a backup or download a fresh copy of functions.php from your theme developer. 

    I know what code I messed up. I just need to access and edit functions.php to fix it.

    See How to edit functions.php above for instructions on how to access and edit your theme or child theme’s functions.php file.

    I have no clue what I did to my functions.php file, but I have a backup.

    If you have a backup on hand, you can access your files either on your web host’s server or your remote server (depending on where you have opted to store these files), and use them to replace your corrupt functions.php file via SFTP or cPanel. 

    If you feel more comfortable restoring your entire site backup rather than trying to restore just the functions.php file, our article, “How to Restore WordPress from a Backup” goes in depth on the different methods you can use to restore your WordPress site.

    I have no idea what code caused the problem and I didn’t make a backup.

    If you don’t have a backup, you can download a fresh copy of the theme you’re using from your theme developer, extract the functions.php file, and overwrite the broken functions.php file on your server via SFTP or cPanel.

    Note: If you’re using a theme that hasn’t been updated in awhile, you may encounter issues in overwriting functions.php with a version that’s from a much more recent update. If you encounter issues, you might be better off just manually updating your entire theme to the latest version. Alternatively, you can contact your theme developer to get the theme files for your current version and use that version of functions.php.

    Can I add JavaScript to my functions.php file?

    Yes, you can add code to your functions.php file that will add your custom JavaScript to either specific pages, posts, or all pages and posts on your site. This article covers all the different ways you can add JavaScript to your functions.php file.

  • How to Detect & Remove Malware from a WordPress Site

    It’s no surprise that WordPress powers 43% of the web. Since it’s open source, people from around the world are constantly contributing to improvements. Plus, because of its huge library of free and premium plugins, it’s pretty simple for someone with limited development knowledge to build a fairly complex site. 

    But, like with anything, WordPress site owners need to be constantly vigilant of cyber criminals who seek to take advantage of security gaps. And one of the biggest threats is malware.

    That’s why learning how to remove malware from WordPress sites is so important. When you can identify when your WordPress site is infected, you can act quickly to clean it and prevent it from happening again in the future.  

    In this post, we’ll discuss the importance of detecting and removing malware on your WordPress site. Then we’ll walk you through how to do so — with and without a plugin. We’ll provide tips for protecting your site against malware in the future and then wrap up with some Frequently Asked Questions (FAQs). 

    The importance of malware detection and removal

    Malware is a piece of software designed to harm or damage a computer system. It can come in the form of a virus, worm, Trojan horse, or spyware. Despite some strong security measures, WordPress sites are vulnerable to malware attacks.

    There are many different ways that malware can get onto your WordPress site. The most common method is through malicious plugins or themes. Other ways include vulnerabilities in the core WordPress software or other software on your server.

    Once the malware has infected a WordPress site, the person behind the attack can do a lot of damage — delete files, inject spammy links into your content, and even steal sensitive information like passwords and credit card numbers. Not only can this attack lead to unnecessary downtime, it can also hurt your reputation and lead to loss of business.

    Without some sort of malware scanning tool, you may not immediately notice when your site has been infected. And the longer malware goes undetected, the more damage it can do. This is where the best WordPress security plugins come into play. They can detect and eliminate threats before serious damage occurs. 

    Identify threats with a free plugin

    If you’re looking for a high-quality, free tool that monitors your site for you, Jetpack Protect is an excellent solution. It scans your site automatically for more than 28,700 vulnerabilities and provides recommendations for securing your WordPress site. 

    Jetpack Protect landing page

    There are no complicated settings or confusing terminology. You can just turn it on, then rest easy knowing that you’ll be alerted the second that malware or vulnerabilities are found.

    This is a great option for small businesses and new websites that want to better secure their WordPress site. Keep in mind, however, that the sole focus of Jetpack Protect is malware and threat identification, not removal. Keep reading for ways to remove malware from your WordPress site.

    How to conduct WordPress malware removal with a plugin 

    The easiest and quickest way to detect and remove malware from WordPress sites is to use a plugin. Fortunately, there are a handful of options to choose from. 

    We recommend Jetpack Scan, which automates the entire process of WordPress malware removal, saving you significant amounts of time and energy. Plus, it’s super easy to set up on your website. It can be purchased on its own, but works best as part of Jetpack’s wider WordPress Security plan that provides comprehensive coverage. Note that it takes the functionality included with Jetpack Protect one step further, with one-click malware fixes.

    Step 1: Scan your WordPress site for malware

    First, if you haven’t already, you’ll need to install the Jetpack plugin and purchase Jetpack Scan. Once the tool is activated, you can scan your WordPress site for malware.

    To do so, navigate to Jetpack and click on the Scan button.

    scanning for malware with Jetpack Scan

    Jetpack will now scan your site for any known malware threats. This process will likely take just a couple of minutes. 

    Step 2: Clean up detected malware (with 1 click)

    Ideally, no malware is detected, and your scan returns a “No vulnerabilities found” result.

    no vulnerabilities found notice with Jetpack Scan

    But if any malware is found, you’ll see a list of issues under Malware Threats Found. To remove the malware, simply click on the Remove threat button next to each one.

    That’s all there is to it! The plugin will automatically clean malware from WordPress for you. Again, this process will take just a few minutes at most.

    Step 3: Remove malware warnings from your WordPress site

    If Google has detected malware on your website, it will likely display a warning to prevent visitors from trying to access it. This is a major problem because most potential visitors won’t proceed past this message.

    So, once you’ve identified and cleaned malicious code from your site, the last step is to remove these warnings. If your site has been flagged, you can file a review request with Google. Then it’s just a matter of waiting for a response. 

    It’s really important that you don’t miss this step. See our full guide on how to remove your WordPress site from Google’s blocklist

    How to conduct WordPress malware removal without a plugin 

    Although it’s usually faster (and easier), you don’t have to use a plugin to remove malware. There are some instances where a plugin may not be able to remove the threat, and in that case, it’s definitely a good idea to know the manual approach.

    It’s important to note that this approach involves a number of steps and requires a decent amount of time. It’s almost always better to use a malware removal plugin, if you can.

    Step 1: Put your WordPress site into maintenance mode

    The first thing you’ll need to do is put your site into maintenance mode. This process hides your website content from visitors and shows a message telling them that your site will return soon. 

    You can put your site into maintenance mode using a plugin like WP Maintenance Mode & Coming Soon.

    This free tool lets you easily enable maintenance mode on your site in just a few clicks. After you install and activate it, you can navigate to Settings → WP Maintenance Mode.

    turning on maintenance mode in WordPress

    Next, select Activated as the Status. When you’re done, click on the Save settings button at the bottom of the screen. Your site will now go into maintenance mode. 

    Step 2: Create a full backup of your WordPress site and database 

    Having a backup of your WordPress site is always a good idea. It can help you recover your site if something goes wrong or you accidentally delete something.

    There are two aspects you’ll need to back up: your database and your files. The database is where your content, settings, and user information are stored. Your files are everything else, like your themes, plugins, and images.

    The best way to do this is with a WordPress backup plugin like Jetpack Backup. Not only does it provide an easy way to download your files and database on demand, it also automatically backs up your site in real-time. So, in the future, every single one of your changes will be saved.

    However, you can back up your WordPress site manually, using File Transfer Protocol (FTP) tools and phpMyAdmin. This method is just more technical and time-consuming.

    Step 3: Identify all malware on your site

    Once you’ve prepped your site, the next step is identifying any malware. This involves searching your database, files, and source code.

    One way to do this is to use a malware scanner tool like Malwarebytes.

    If you’re looking to identify malware manually, you’ll need to go through each of the key areas of your site to look for signs of infection. In your database, you can search for common syntaxes often used by cybercriminals (you can refer to Step 9 for some popular examples of malicious PHP).

    If you’re scanning your source code for malware, there are two main types of attributes to look for: script and iframe. Lines that start with “script=>” or “iframe src=URL>” and contain suspicious URLs or file names are common red flags. 

    Step 4: Replace all WordPress core files with a clean installation

    If you have a corrupted WordPress installation, one of the best ways to clean your hacked site is to replace all of the core WordPress files with a fresh set. When doing this, you’ll only keep your original wp-config.php file and wp-content folder.

    First, download a fresh copy of WordPress from WordPress.org.

    Unzip the file, then delete the wp-config.php file and wp-content folder. These are the only two folders you should delete — everything else should be left intact. 

    Next, you can use your File Manager or FTP client to upload the remaining files to your server. This step will overwrite your existing installation. Learn how to bulk upload files via FTP. 

    Step 5: Remove any malicious code from the wp-config.php file

    It’s also a smart idea to compare your wp-config.php file to the original offered by the WordPress Codex. This step will make it easier to identify and locate anything that has been added (like malicious code).

    From the WordPress Codex, download a fresh copy of the wp-config.php file. Open the file as well as your existing wp-config.php file in a text editor to compare them. There are some legitimate reasons your file may be different from the original â€” especially when it comes to information about your database — but take the time to look for anything suspicious and remove it if necessary. When you’re done, save the cleaned-up file, then upload it to your server. 

    Step 6: Re-install a clean version of your theme

    Next, you’ll want to re-install a clean version of your WordPress theme. But if you’re using a child theme (a copy of your theme with the functions and styling of its parent, plus custom edits), you don’t want to lose all of your work. Therefore, you’ll need to reinstall a clean version of your theme while keeping your child theme intact.

    From your WordPress dashboard, navigate to Appearance →Themes, then deactivate your parent theme. Next, go to your File Manager or FTP and delete your parent theme folder.

    deleting a parent theme in cpanel

    If you’re using a theme from the WordPress repository, head there, search for your theme, then download the latest version. If you’re using a premium theme, or a free option from elsewhere, you’ll need to download your theme files from that source. From your dashboard, navigate to Appearance →Themes, then select Add New → Upload Theme.

    adding a new WordPress theme

    Select the zipped file you just downloaded. After uploading it, click on the Activate button. 

    Now you can activate your child theme. Your site should now be running the latest version of the parent theme, with all your customizations from the child theme intact.

    Step 7: Check for recently-modified code files and repair them

    The next step is to look at any files that have been recently modified. To do this manually, you can connect to your site via FTP or File Manager, then sort your files based on the last modified date column:

    finding recently-modified files

    Make a note of any files that have recently been changed. Then go through each of them to review the code for suspicious additions. These could include PHP functions such as str_rot13, gzuncompress, or eval.

    Step 8: Clean hacked database tables

    If your WordPress site has been infected with malware, there’s a chance that it created malicious content in your database tables. 

    To clean your tables, log in to your phpMyAdmin dashboard — available through your hosting provider — then navigate to the database table that has been infected with malicious content to remove it. You can determine which tables have been affected using a scanner tool (like Jetpack) or by comparing the original files to your current ones.

    Note that you should create a backup of your site first, and you can find the original files in previous backups. You can then look for commonly-used functions (see the next step), suspicious links, etc. If you locate any, you can manually delete that content.

    Save your changes, then test your website to verify that it’s still working correctly. If you don’t want to modify your database tables manually, you can also use a tool like WP-Optimize.

    While it’s not a malware removal plugin, it can clean and optimize your database. But, if you want to use a plugin to detect and clean WordPress malware, we recommend a dedicated solution like Jetpack Scan

    Step 9: Identify and remove hidden backdoors

    When hackers gain entry into your site, they’ll often leave behind a hidden ‘backdoor’ (a way to get back in). This entry area is usually embedded into files that are similarly named to your regular WordPress files, only placed in the wrong directory locations. 

    To identify and remove hidden backdoors from your WordPress site, you’ll need to search popular files and folders, including wp-content/plugins, wp-content/uploads, and wp-content/themes

    When checking these files, there are a variety of PHP functions to look for, including:

    exec

    system

    assert

    base64

    str_rot13

    gzuncompress

    eval

    stripslashes

    preg_replace (with /e/)

    Move_uploaded_file

    These functions don’t inherently indicate malicious activity. But the manner and context in which they’re used can sometimes indicate and introduce risks. 

    For example, malicious PHP usually:

    • Is located immediately before or after valid code, so that it can run undetected.
    • Contains long strings of random characters (letters and/or numbers).
    • Was recently inserted into your code.
    • Contains reinfectors (malware that duplicates if you delete it) like 444 permissions or fake plugin folders.

    As with database tables, we recommend comparing your existing files to the originals to determine whether there’s a legitimate reason for the code to be there.

    Note that editing WordPress files can break key functions of your site, so it’s best to only do this if you have experience working with them. Otherwise, we recommend using a plugin like Jetpack Scan or hiring a professional.

    How to protect your WordPress site from future malware attacks 

    Learning how to remove malware from WordPress sites is incredibly useful. But it’s better to know how to prevent malware from infecting your website in the first place. Let’s discuss some actions you can take!

    1. Change your WordPress password and database credentials

    One of the most important things you can do to prevent malware attacks on your WordPress site is to change your password and database credentials regularly. Doing this can make it much more difficult for hackers to access your site.

    To change your password, log in to your WordPress dashboard and go to Users → Profile.

    From here, you can scroll to the Account Management section and select Set New Password.

    setting a new password in WordPress

    When you’re done, click on Update Profile at the bottom of the screen. Once you’ve changed your password, be sure to log out of all active sessions on your website. These include any devices or browsers you may have used to access your WordPress site.

    You should also regularly change your WordPress database credentials. To do this, you’ll need to edit your wp-config.php file. This file is located in the root directory of your WordPress installation and can be accessed via FTP or File Manager. 

    Once you’ve opened wp-config.php, look for the following lines:

    // ** MySQL settings - You can get this info from your web host ** //
    /** The name of the database for WordPress */
    define( 'DB_NAME', 'database_name_here' );
    /** MySQL database username */
    define( 'DB_USER', 'username_here' );
    /** MySQL database password */
    define( 'DB_PASSWORD', 'password_here' );
    /** MySQL hostname */
    define( 'DB_HOST', 'localhost' );

    You’ll want to update the DB_NAME, DB_USER, and DB_PASSWORD values with new ones. Once you’ve done that, save and close the file.

    For these values to work, you’ll also have to update them on your server so that they match. To do this, you can log in to your phpMyAdmin account and navigate to your database. Next, open the users table and select Edit.

    editing a user in the WordPress database

    You can update the credentials as necessary. When you’re done, click on the Go button.

    2. Regularly update your WordPress site, themes, and plugins

    Outdated software is one of the most common ways hackers gain access to WordPress sites. Therefore, another way to prevent malware attacks is to keep your website updated. This step helps ensure your site has the latest security features and patches.

    To update WordPress core, log in to your dashboard and click on Updates. If there’s a new version of WordPress available, you’ll see a notice at the top of the screen.

    updating WordPress

    You can click on the Update button to install the latest version.

    Updating your plugins and themes is just as important as updating WordPress itself. Most plugin and theme developers release security updates regularly.

    You can do this by logging in to your WordPress site and checking the Updates tab. You’ll see any available plugin or theme updates under the main WordPress version updates.

    Then, select the Update Plugins or Update Themes button to install the latest versions. If you want to automate this process, you can also use the Jetpack’s Automatic Plugin Updates feature. It will automatically install new versions of WordPress, plugins, and themes as soon as they’re released.

    You’ll need to install and activate the Jetpack plugin to enable this feature. Once you connect it to your WordPress.com account, you can navigate to Jetpack → Settings → Writing

    Next, scroll to the Automated Updates section at the bottom of the page, then select which types of updates you want to enable: WordPress Core Updates, Plugin Updates, and/or Theme Updates.

    When you’re done, remember to save your changes. You can also manage updates on your Activity Log page. You can select the Update All button to run them all at once. 

    3. Install an automated malware scan plugin for WordPress

    You should also regularly scan your WordPress site for malware using a plugin like Jetpack Scan. Jetpack Scan will review your site for known malware and send you an email if they find anything wrong.

    Once you download and install the plugin on your site, you can access the malware scan tool by clicking on Jetpack → Backup & Scan in the WordPress dashboard. There, you can see the current status of your site, and run a new scan if you’d like.

    4. Install an automated backup plugin for WordPress

    To prevent malware attacks and practice good overall security for your WordPress site, we suggest installing an automated backup plugin like Jetpack Backup.

    turning on backups with Jetpack

    Jetpack Backup is the best WordPress backup plugin because it saves your website in real-time. If anything changes — a page is updated, a post is published, a product is purchased, etc. — the latest backup file will reflect that. Plus, it integrates seamlessly with Jetpack Scan.

    So, if malware is found on your site, you’ll get a notification from Scan letting you know. Then, you can immediately restore a backup from right before the hack happened — even from your mobile device, if you’re on the go! — and skip all the complicated malware removal steps above.

    WordPress malware removal FAQs

    At this point, hopefully, you have a solid understanding of how WordPress malware detection and removal work. To ensure we covered the key areas, let’s wrap up with some FAQs!

    What are the signs of a WordPress malware infection?

    There are several signs that your WordPress site has been infected with malware. First, you may notice your site loading slowly or displaying error messages.

    Second, you may see new users or files appearing on your site that you didn’t add. Finally, you may find that your website is on Google’s blocklist or is being blocked by visitors’ antivirus software.

    If you see any of these signs, it’s important to take action immediately to clean up your WordPress site. Ignoring a malware infection can lead to severe consequences, including data loss and website downtime.

    How does malware generally infect a WordPress site?

    There are a few different ways that malware can infect a WordPress site. First, it can come in through a WordPress plugin or theme vulnerability.

    It can also be uploaded by a hacker who gains access to your site through an insecure password or other method.

    Can I remove malware from WordPress myself?

    You always have the option of hiring an outside firm to remove malware from your site, but it usually gets pretty expensive. Instead, you can identify and remove malware from WordPress using a plugin like Jetpack. This is a fast, easy, and reputable solution. 

    If you’re an experienced developer, yes, you can manually remove malware from WordPress. This is a tedious process that has the potential to cause major errors on your site. You should proceed with caution if you choose this option. 

    Strengthen the security of your WordPress site

    WordPress is a flexible and powerful CMS, but because it’s so popular, hackers will sometimes target sites that use it. One of the most significant risks facing WordPress websites is malware.

    As we discussed in this post, there are multiple methods to detect and remove malware in WordPress. The easiest and fastest solution is to use a plugin like Jetpack. Alternatively, you can conduct malware removal manually. We also recommend regularly updating your WordPress software and creating backups to prevent issues in the future. 

    Looking for a hands-off, trusted way to automatically monitor your site for malware and vulnerabilities? Try the free Jetpack Protect plugin. 

    Do you want to take advantage of one-click malware removal and a library of additional security features? Get Jetpack Security today!