Nawraskh

Thanks for the reply.

Actually i didn’t rule out themes and plugins because the script appears every 2-3 days, so i can’t deactivate the theme for long time.

I believe the problem is with the theme, the hackers inserted something in it, but i can’t find it. i followed all the steps in the provided links

Thanks Tara for the response.

As i mentioned , i delete the script but it appears again after 2-3 days in all “header.php” for all themes including (Twenty Sixteen, etc.)

I did all that, deactivated themes and plugins, deleted the themes and plugins that i don’t use. Also, i use Wordefence which can’t detect any malware.

Earlier today, i deleted the script from all headers ” all themes” , this is the 4th time i do in the last 10 days. In 2-3 days, it will appear again with only one change, the link “var base = “https://bestratetowing.com/js/jquery.min.php””

Also, every few days, a new user is added without registration.

So i am not sure how the script is keep being added to the “header.php”

thanks a lot, you are the best.
I found the script in 27 files, i think it is a hack
Thanks agian

same problem but with waiting for zolotoy-darken.ru which i don’t know what it is as my website is https://www.pmvision.ca. hope somebody will answer

if you click in more than one page, “for example, Home, then blog, then teach , you will see how slow some of the pages are

Thanks for the response. i really appreciate it. i will work with the image

The problem is with all pages and posts. in the status bar, it shows waiting for” zolotoy-darken.ru”. and it cause the delay and sometime the page turns white for few seconds