How to Fix “Site ahead contains harmful programs” Error in WordPress

WordPress is one of the easiest, most straightforward website hosting and creation platforms around. But even WordPress isn’t impervious to those infamous “This site ahead contains harmful programs” errors.

These error messages can occur when there’s bad backend code, Google-flagged reports, and more. Suffice to say it’s imperative you, as the website owner, fix whatever the problem is ASAP, getting your site back up and visible to those who are searching for it.

Currently dealing with one of these errors or want to learn how to fix (and prevent) one in the future? Keep on reading to see how you can repair and safeguard your WordPress site from “this site ahead contains program” errors.

Scan Your Site for Malicious Code

One of the leading reasons why these messages pop-up is because there may (or may not) be lines of malicious, flagged code. These are particularly common when advertising with low quality, budget-based advertising networks.

Thankfully, this can be rectified. Use Google’s safe browsing analysis tool, which will comb through your website’s code and point out any malicious code.

Here’s the URL parameter to use the above-mentioned tool:

https://www.google.com/safebrowsing/diagnostic?site=YourDomain.com

Simply add your site’s domain in the URL space titled “YourDomain.com.”  Afterward, if you have malicious code, take note of those lines. You’ll need to know those later to successfully remove them from your site and, thus, fix this critical error message.

Create a Backup of Your Entire WordPress Website

Before you go about removing lines of code from your website, create a complete backup.

When you start digging in the backend of your WordPress site and start deleting code, it’s all too easy to remove the wrong line—which, in some cases, could leave your website inoperable. But by creating a backup, you can easily come back from any accidental mistakes.

Also, creating a website backup is important to safeguarding user and customer information, as well.  Programs and plug-ins like BackupBuddy, UpdraftPlus, and BackWPUp are all well-reviewed, safe third-party providers that make doing this a breeze.

Remove Suspicious or Malicious Code

Now that your websites backed up and save from permanent error, let’s get into the business of finding and deleting that malicious code.

Using the code generated by the Google Safe Browsing tool, open-up your site’s Web Editor. This will display all your sites code. To save yourself time and future headaches, use the “Control-Find” option and paste in the line of code you’re looking for, which will show you the highlighted code you’re looking to delete.

For your own use, below is an example of malicious and/or suspicious. code:

function v78 FAX($vJOJJ7T, vRJ8WGX){$vM74216 = ''; for($i=0; $i < strlen($vJOJJT); $i++){$v74216 .= isset(vRJ8WGX[$vJOJJ7T[$i]]) ? $vRJ8WGX[$vJOJJT[$i]] : $vJOJJ7T[$i];}
return base64_decode($vM74216);}

Word to the wise: Maclious code often contains “base64_decode” somewhere in it. Also, malicious code will often include code that “redirects” or turns off “error reporting.” Below is an example of just that:

str_rev(edoced_46esab('ZXJyb3JfcmVwb3J0aW5nKDApOw0KJHRydW09aGVh = error_reporting(0); or error_reporting(E_ERROR | E_WARNING | E_PARSE); or ini_set('display_errors', "0");

Granted, all these lines of malicious code should appear when you run the Google Safe Browsing Tool. But, for future reference, it helps to know these to pinpoint chronic “This site ahead contains harmful programs” errors.

After you’re done removing the bad code, re-run your website through the Google tool. This will ensure there’s no more malicious code in your site, prior to doing the next step.

Have Google Remove Your Site From it’s Flagged Test

Once you’re 100 percent sure your site is free from malicious code, now you’ll need to have Google remove your site from its flagged list.

To do this, use Google’s Webmaster tools. After adding your page to the Webmaster Tool, check for any security issues associated with your website. And, again, once you’re absolutely sure you’ve recertified those issues, click on the “checkbox” and request your WordPress site be reviewed.

Upon review, should everything be squared away, your site will have the dreaded “This site ahead contains harmful programs” errors removed.

In Conclusion: Find the Malicious Code, Backup Your Site, Delete Said Code, and Ask for a Review

As you can tell by now, getting rid of these errors isn’t as straightforward as it might seem—but it can be done, nonetheless. Follow the above-mentioned steps in chronological order, and rest easy knowing your WordPress won’t throw any “This site ahead contains harmful programs” error messages, anymore.

How to fix WordPress admin login error

Can’t log into your WordPress Admin Dashboard? Don’t worry, it’s a common error and there’s more than one solution. In this tutorial, we’re going to cover a few ways of solving this problem.

Reset admin user password

If you can’t log into your Admin Dashboard it could be that you have the incorrect password. But, there’s a quick solution; you can always reset it.

Here’s 3 few ways to reset your admin password.

Resetting admin password with email access

First you want to navigate to your WordPress Admin Login page.

This will be located at the following URL,

 http://www.yourdomain.com/wp-admin/

Click on Lost your password? underneath the Username and Password fields.

When prompted, enter the username or email address of the admin account and click Get New Password.

Click on Lost your password? link

Enter your admin username or email address

A temporary password will be emailed to you. You can always choose to change it once you’ve successfully logged back into your site.

Resetting admin password in the WordPress database

If you no longer have access to your email, you can reset your password by editing the WordPress database using phpMyAdmin.

phpMyAdmin is an open source MYSQL database administration tool which is quite popular and is usually included with most web hosting accounts.

Start by logging into your hosting account / cPanel account.

Under the DATABASES section you’ll see a link for phpMyAdmin. Click on it.

phpMyAdmin located in cPanel hosting account

When phpMyAdmin opens, you’ll see a list of database names. Locate the one for your website and click on it.

If you’re unsure of the name of your database, look inside the wp-config.php file located in the root directory of your WordPress site.

Look for the following code:

/** The name of the database for WordPress */
define('DB_NAME', 'your_db_name');

In phpMyAdmin, when you select your database name, a list of table rows will be displayed.

Locate the wp_users table row.

wp_users table row in phpMyAdmin

Click on wp_users.

The wp_users table will list all the user accounts on your site and their passwords. However, it’s the admin user that you’re interested in.

Click Edit next to the administrator username.

From the Functions dropdown, select MD5. In the value field, enter your new password.

Change admin user password in wp_users table

Then, save your changes and try to log into your Admin Dashboard with the new password.

Note: Using phpMyAdmin to edit your database may break your website. Make sure to download a backup of your database before you make changes.

Reseting admin password by editing functions.php file

If the previous two solutions didn’t work to reset your password you can always resort to editing the functions.php file.

The file is located in your themes directory and not in the WordPress root directory.

The path to your themes directory looks like this,

/public_html/wp-content/themes/twentyseventeen

Connect to your site via FTP or access the File Manager from within your hosting account and navigate to the functions.php file for your active theme. For example:

public_html/wp-content/themes/twentyseventeen/functions.php

Edit the file and add this code to it, right at the beginning, after the first <?php:

wp_set_password( 'password', 'admin' );

Put in your own new password for the main admin user. The “admin” is the administrator user ID in the wp_users table.

Note: In this instance, our username is ‘admin’ and our chosen password is ‘password’.

Then, save your changes and try to log into your Admin Dashboard.

If you can, visit My Profile to set a new password and save your changes.

The final step of this solution is important.

Once you’ve changed your password, you need to re-open functions.php and delete the code you just added.

If you don’t, WordPress will continue to reset your password.

Enable cookies and clear cache

Although you can disable cookies in your browser (Chrome, Firefox, Safari & Edge), I don’t recommend it when working with WordPress.

WordPress requires cookies to function properly, and some errors can be cookie-related.

Check to ensure that your cookies are enabled in your browser. If they aren’t, enable them.

After enabling the cookies, you should then clear your cookies and cache.

You can also do this in Windows by hitting the ctrl+shift+del keys and on Mac with cmd+shift+del keys.

Once your cache has cleared, reload your page and try to log in again.

If it’s still not fixed, it could instead be a plugin issue.

Disable plugins

If none of the above steps have worked, it’s likely that you’re dealing with a faulty plugin. This is a common cause of many WordPress errors.

That said, there’s no way to tell which plugin is causing the problem.

So, you must deactivate all of them at once, then re-enable them one by one.

You can do this via FTP or with the File Manager within your hosting account.

Locate the plugins directory within your WordPress installation. The path is:

public_html/wp-content/plugins

To disable all your plugins at once, simply rename the folder to plugins_backup.

Now, try to log in to your site again.

If you’re able to log in then you know one of the plugins is the cause of the problem. However, you don’t know which one.

This is why you now need to change the plugins folder back to it’s original name and deactivate the plugins one-by-one by renaming them.

Once you’re able to log in again you will have found the problematic plugin.

Deactivate your currently active theme

Like plugins, themes can also cause their share of problems.

To see if your active theme is the cause of the problem, you can switch to another theme.

Follow the same steps you completed to disable the plugins but instead navigate to the themes directory.

public_html/wp-content/themes/

In that directory you’ll see a list of theme names.

Rename your current active theme folder and try to login again.

If deactivating your theme didn’t work either, let’s move on to the next fix.

Disable .htaccess file and create a new one

If you’re logging in and being redirected to a 404 error page, you can fix this a couple of ways. Disabling .htaccess is one of them.

To do this, go to your WordPress root directory and locate the .htaccess file.

WordPress htaccess file location

Re-name the file to .htaccess.old and try to log in.

If you’re able to log in, all you need to do now is to generate a new .htaccess file.

You can do this in your Admin Dashboard by going to Settings > Permalinks and clicking SAVE. Doing this will regenerate the .htaccess file.

Update your site URL

If creating a new .htaccess file didn’t work, you can try to update the URL of your site via FTP or with the File Manager within your hosting account.

To update your site URL, you have to edit the wp_config.php file. This file is also located in your WordPress root directory.

Edit the file and add the following code:

define('WP_HOME','http://www.yourdomain.com');

define('WP_SITEURL','http://www.yourdomain.com');

This will refresh the URL where your WordPress files are located and also the URL to your homepage.

If you’ve tried all of the above issues and still can’t log in, I suggest contacting your hosting provider for assistance.

Feel free to let us know in the comments below if any of these solutions worked for you.

How to set up error logs in WordPress to diagnose issues

Error logs can help you to diagnose issues affecting your site. This is achieved by configuring the wp-config file of your WordPress site.

The wp-config.php file is a WordPress configuration file that contains important settings. These settings tell your website how to connect to your WordPress database, which database table prefix to use, and generates authentication keys to make your WordPress site more secure.

But, it also works as a handy debugging tool, which allows you to find and debug errors.

In this tutorial, I’m going to cover the basics of setting up error logs in WordPress and what they mean.

Why do you need error logs?

Finding the root cause of errors in WordPress can sometimes be frustrating and time consuming.

Setting up error logs will help you find those issues quickly, and point you to the root cause of the errors.

Whether you fix the errors yourself or ask a professional, the error logs are an important piece of the puzzle.

Error logs are also useful in keeping track of bugs that might enter your system through plugin updates or bad code.

How error logs can help us diagnose issues

Depending on the type of error, a simple Google search can help you find a solution.

Each line that’s visible in the error log describes the error and displays the file URL which triggered the error.

However, it also uses PHP terminology. Here is how one line of the error log could look like,

PHP Fatal error: Call to undefined function verb_lite_entry_categories() in /home/ivgserve/public_html/simplex/wp-content/themes/simplex-lite/loop-templates/content-featured.php on line 23

For beginners who aren’t familiar with PHP code, this can be daunting. Don’t worry, further on in this tutorial I’ll explain how to use error logs to debug issues.

How to setup error logs in wp-config

Until you’ve enabled debug mode, WordPress won’t create or store your error logs. So, you have to enable the built-in debugging feature yourself.

Here’s how you do it.

Enabling the WordPress debug mode

To enable the debug mode, you need to edit the wp-config.php file.

Start by either logging into your hosting provider’s cPanel or access the site via FTP.

Go to your cPanel File Manager or public_html in your FTP and locate wp-config.php.

Open the file to edit it and find the line that says “That’s all, stop editing! Happy blogging.”

Right before this line, insert the following code.

define( 'WP_DEBUG', true );

define( 'WP_DEBUG_LOG', true );

define( 'WP_DEBUG_DISPLAY', false );

The save your changes.

The WP_DEBUG line activates the WordPress debug mode. However, it only displays the errors and doesn’t store them in the log file. You’ll see the errors and warnings in your dashboard and on the front-end of your site.

It’s possible this line of code is already present in your wp-config file and will be set to false. In that case, simply change it to true.

The WP_DEBUG_LOG line is what stores the errors in the log.

Finally, the WP_DEBUG_DISPLAY line should be used in conjunction with the other definitions.  This one controls whether or not the debug messages are inside the pages’ HTML or not.

Note: If any of the above lines of code are already in the wp-config file, replace them with the code mentioned previously.

Once you reload your site, it will generate an error_log file which will be located in your WordPress root directory.

Error_Log file located in WordPress root directory

Reviewing the error logs

In order for you to be able to review the logs, you’ll need to trigger them so the system can log them in the error_logs file. You can do this by visiting the pages which where triggering errors. Each page you visit will trigger the errors and the system to record them in the error_logs file.

Then, open the error_logs file and review the logs. It will look something like this,

[21-Oct-2016 16:49:38 UTC] PHP Fatal error: Call to undefined function verb_lite_entry_categories() in /home/ivgserve/public_html/simplex/wp-content/themes/simplex-lite/loop-templates/content-featured.php on line 23
[21-Oct-2016 16:50:51 UTC] PHP Fatal error: Call to undefined function verb_lite_entry_categories() in /home/ivgserve/public_html/simplex/wp-content/themes/simplex-lite/loop-templates/content-featured.php on line 21
[21-Oct-2016 16:54:41 UTC] PHP Fatal error: Call to undefined function verb_lite_entry_categories() in /home/ivgserve/public_html/simplex/wp-content/themes/simplex-lite/loop-templates/content-featured.php on line 22

Error logs usually have the following structure,

• Date
• Error type
• Error description
• File path & line number

This will point you to the files and specific lines of code which are triggering errors.

You can then go line-by-line and find solutions to each error.

This tutorial doesn’t cover how to solve individual WordPress errors, just how to set up the error logs.

But there is a quick & simple way to find solutions for errors.

Use Google to find solutions

Copy and paste each line of the error log into Google but remove any code specific to your site.

Take this line for example,

[21-Oct-2016 16:49:38 UTC] PHP Fatal error: Call to undefined function verb_lite_entry_categories() in /home/ivgserve/public_html/simplex/wp-content/themes/simplex-lite/loop-templates/content-featured.php on line 23

Remove the date and URL specific to your site but include the file name.

PHP Fatal error: Call to undefined function verb_lite_entry_categories() content-featured.php on line 23

Then enter this in a Google search.

You’ll most likely find results for WordPress Support forums or Stack Overflow from users who’ve had similar issues.

If you search through the results, or directly in the WordPress & Stack Overflow forums, you’ll most likely find a solution.

I hope you found this useful, if you have any comments or questions, use the comment form below.