Edit-comments.php seems to be hacked

That seems odd a script would be inserted to reference a specific comment URL on your site.

Try downloading WordPress again and delete then replace your copies of everything except the wp-config.php file and the /wp-content/ directory with fresh copies from the download. This will effectively replace all of your core files without damaging your content and settings. Some uploaders tend to be unreliable when overwriting files, so don’t forget to delete the original files before replacing them.

Thanks James, I replaced the files in wordpress as you suggested. That didn’t work.

Then I looked at this link and tried the author’s suggestion https://wptavern.com/a-bug-in-chrome-45-causes-wordpress-admin-menu-to-break That didn’t work either because the issue can still be seen on safari and firefox.

I tried to find the source thought my pages but couldn’t.

I simply don’t know how to git rid of it.

Dave

Hm, I wonder if it’s being added by a plugin or theme function.

Try deactivating all plugins. If that resolves the issue, reactivate each one individually until you find the cause.

If that does not resolve the issue, try switching to the Twenty Fifteen theme to rule-out a theme-specific issue (theme functions can interfere like plugins).

If those make no difference either, then it’s unfortunately time to suspect something more nefarious. ??

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

I use Headway Theme. After I reported the problem to them, they made the same suggestion. I disabled all the plugins and switched to 2015. the problem still persisted.

I’ll take a look at the links you provided. I already have a fairly tight .htaccess for example Thanks again.

You’re welcome!

Still not fixed. I’m at a loss. Should expect something more nefarious.

Did you follow everything at https://codex.www.ads-software.com/FAQ_My_site_was_hacked ?

Yes.

Ok, you might need to hire someone so you can give them direct access to dig this out for you.

Please try https://jobs.wordpress.net/ or https://directory.codepoet.com/ and do not accept any hire offers posted to these forums.

James,

Thanks for your attention to this. I reinstalled a back up of an .htaccess file I saved in September 2015 (glad I had it) and the problem is gone. I don’t know what the culprit is but when I find out I’ll report back.

Thanks again.

Dave

You’re welcome!