A theme file has been modified

What Wordfence found

The same comparison as for plugins, applied to themes from the WordPress.org directory.

Why it matters

Theme files are the most commonly hand-edited files on a WordPress site, so this finding has the highest benign rate in the file-change category. It still matters: header.php and footer.php are classic places to inject a script tag that runs on every page.

How to fix it

1. 1Check the diff. An appended script tag or an iframe at the end of header.php or footer.php is an injection, not an edit.
2. 2If it is an injection, follow the malware steps rather than just reverting the file.
3. 3If it is a deliberate customisation of a parent theme, move it to a child theme so it survives updates.
4. 4Delete themes nobody uses — an inactive theme's files still sit on disk and are still writable.

How WPSecureOps treats it

The connector reports this as themeFile. WPSecureOps files it under File change and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.