A theme file has been modified

Modified theme file: wp-content/themes/twentytwentyfour/functions.php

What Wordfence found

The same comparison as for plugins, applied to themes from the WordPress.org directory.

Why it matters

Theme files are the most commonly hand-edited files on a WordPress site, so this finding has the highest benign rate in the file-change category. It still matters: header.php and footer.php are classic places to inject a script tag that runs on every page.

How to fix it

1. 1Check the diff. An appended script tag or an iframe at the end of header.php or footer.php is an injection, not an edit.
2. 2If it is an injection, follow the malware steps rather than just reverting the file.
3. 3If it is a deliberate customisation of a parent theme, move it to a child theme so it survives updates.
4. 4Delete themes nobody uses — an inactive theme's files still sit on disk and are still writable.

Common questions

We customised our theme. Is this finding just noise for us?

If you edit the theme directly, yes — every edit flags. That is a reason to move customisations into a child theme: the parent then stays identical to its published version and this check regains its value. A modified-file alert is only useful when an unmodified state is the norm.

Why is functions.php the file that always gets flagged?

Because it runs on every request, making it the single most valuable file in a theme to infect. Injected code in functions.php executes site-wide without needing activation, registration, or a visible trace in the admin. Any diff there that you did not write deserves a line-by-line read.

The diff is just whitespace or line endings. Ignore it?

Whitespace-only diffs usually mean the file was opened and saved by an editor or transferred with different line endings — cosmetically changed, functionally identical. Confirm the diff really contains no code change, then ignore the issue in Wordfence so it stops resurfacing. Re-check if the file flags again with a different hash.

How WPSecureOps treats it

The connector reports this as themeFile. WPSecureOps files it under File change and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.

1. Wordfence: How to interpret scan results
2. WordPress Developer Resources: Verify core file checksums with WP-CLI
3. Wordfence: If your site is hacked