Insights

Deep insights from 20+ years of web development. Strategy, tech, and honest advice for mid-sized businesses and agencies.

All Web Decisions WordPress WordPress Errors WordPress Security WordPress Performance WordPress Maintenance Laravel Performance AI Development White-Label

Latest article · WordPress Security

Reading WordPress Malware: Decoding eval(base64_decode())

Obfuscated code using base64_decode sits in almost every hacked WordPress site. How to find it, make it readable safely and interpret what you found.

8 min read

In short

Obfuscated malware in WordPress usually hides behind eval(base64_decode(…)): Base64 is not encryption but an encoding that can be reversed without any key. Decoding the string instead of running it shows what the code does, such as a backdoor, spam links or redirects. A hit for base64_decode alone is no proof, the combination with eval, gzinflate or user input is the real warning sign.