faisalahammad

WordPress Malware Detection & Cleanup Assistant (Hostinger Multi-Site)

You are an experienced WordPress security engineer specializing in malware analysis and cleanup, operating on a Hostinger account with multiple WordPress installations under www/public_html/.

Your task is to inspect each WordPress installation and identify malware, backdoors, web shells, SEO spam, hidden redirects, malicious JavaScript, and suspicious modifications.

Do not assume everything suspicious is malicious. Minimize false positives and explain your reasoning.

Operating rules (read this first, every time)

faisalahammad

<?php
/**
 * Plugin Name: Gravity Forms + Pods Integration
 * Description: Automatically adds Pods User fields to the User Registration Add-On meta keys list, and properly casts mapped Checkbox values into strict booleans (1/0) for Pods boolean fields.
 * Author: Faisal Ahammad <me@faisalahammad.com>
 */

// 1. Add Pods User fields to the GF User Registration Meta Key dropdown
add_filter( 'gform_user_registration_user_meta_options', function( $keys ) {
	if ( ! function_exists( 'pods_api' ) ) {

faisalahammad

/* ============================================================
   Dark Mode Fix — Gravity Forms
   @author: Faisal Ahammad <me@faisalahammad.com>
   ============================================================ */

/* -- GF CSS custom property overrides -- */
html.dark-skin .gform_wrapper {
  --gf-color-primary:          #5b8af8;
  --gf-color-secondary:        #4a78e8;
  --gf-color-in-ctrl:          #2a2d32;  

faisalahammad

<?php
/**
 * Allow URLs starting with "www." in Gravity Forms website field validation.
 *
 * This snippet enables users to enter URLs like "www.example.com"
 * without needing to type "https://". It prepends "https://" internally
 * for validation purposes.
 *
 * @author Faisal Ahammad <me@faisalahammad.com>
 */

faisalahammad

<?php

/**
 * Modify Gravity Forms Stripe charge description when Tax Code is in product meta
 *
 * @description Modify Gravity Forms Stripe charge description by adding tax code from product meta for cleaner, SEO-friendly payment records.
 *
 * @author Faisal Ahammad <me@faisalahammad.com>
 */

faisalahammad

<?php

/**
 * Modify Gravity Forms Stripe charge description to "Tax Code - Short Description"
 *
 * @description Gravity Forms PHP snippet to generate and truncate Stripe charge descriptions with tax code and product short description. Ensures description fits Stripe's 22-character limit by truncating intelligently.
 * @author Faisal Ahammad <me@faisalahammad.com>
 */

add_filter('gform_stripe_charge_description', 'gf_custom_stripe_charge_description', 10, 5);

faisalahammad

<?php
/**
 * UK Postcode Validation for Gravity Forms
 * Adds custom validation using regex to ensure proper UK postcode format.
 * 
 * Usage: Replace X_Y with your form ID and field ID (e.g., 5_3).
 *
 * @author Faisal Ahammad <me@faisalahammad.com>
 * @source https://community.gravityforms.com/t/input-mask-for-uk-postcode/20004
 */

faisalahammad

<?php
/**
 * Disable Gravity Forms email notification when "Other Amounts" is 0 or $0.00.
 *
 * Replace '3' with your Gravity Form ID.
 * Replace '6915837c16509' with your Notification ID (nid).
 *
 * @author faisalahammad <me@faisalahammad>
 * @ticket https://community.gravityforms.com/t/using-conditional-logic-to-not-send-confirmation-email/19851/
 */

faisalahammad

Ninja Forms Auto Email Copy - jQuery Solution

This jQuery script automatically copies an email address from one field to multiple other fields when a checkbox is checked. Perfect for forms where users want to use their business email for multiple purposes (billing, support, marketing, etc.).

Features

• ✅ Copy email from main field to multiple target fields
• ✅ Real-time updates when main email changes
• ✅ Fields remain editable for user overrides
• ✅ Clears target fields when checkbox is unchecked
• ✅ Waits for DOM elements to load properly

faisalahammad

<?php
/**
 * Ninja Forms phone export unescape plus
 *
 * Prevents the core CSV export from keeping a leading apostrophe for phone numbers that start with a plus sign (e.g. +441234567890). This snippet detects values like "'+441234..." added by CSV-escaping and removes the leading apostrophe only when the rest of the value matches a reasonable phone pattern.
 * @author Faisal Ahammad <me@faisalahammad.com>
 */

add_filter('ninja_forms_subs_export_field_value_phone', function ($value, $field) {
    // Normalize to string