The URL you mentioned is a JavaScript file that appears to be included in every browser rendering of your website. It’s written in a strange way and appears directly in the header section of the HTML code.
At first glance, it looks like your project has been compromised. My recommendation: first read this article:
FAQ My site was hacked
First, you should definitely check to see if you have a security plugin, and if so, run a scan with it. If you don’t have one, install one – there are plenty to choose from: https://wordpress.org/plugins/tags/security/
If you find anything along the way, follow the instructions.
However, if the scan doesn’t find anything, you’ll need to take a closer look at your project. First, check the theme – you have a child theme where you can also configure such settings individually. If you find that line in the functions.php file, ask the person who created the theme why it’s there. When in doubt: remove it.
Checked the functions.php in both main theme & child theme. No such script code found.
Scanned with :
WP Ninja (free version). All clean.
Site lock: all clean
Wordfence: Clean
Using Elementor theme, no specific theme
Hi @raunharmantech,
Are you using any security plugins like Wordfence? If so, run a full site scan after a full site backup. This will help you find the infected files.
Refer to the following tutorials for more details.
https://www.sucuri.net/guides/how-to-clean-hacked-wordpress/
FAQ My site was hacked
When the script is in every page but scanners say “clean”, it is usually stored in the database rather than in a file, and most scanners only check files. Places worth checking, in this order:
- Elementor > Custom Code, and any “header and footer scripts” or code-snippet plugin. Injected code often lands there because it runs on every page.
- The database itself: in phpMyAdmin, search all tables for “coredelivr”. It is most often in wp_options or wp_postmeta.
- wp-content/mu-plugins: files here load automatically and do not show in the normal plugin list.
- Users > All Users: look for an administrator you did not create.
Removing the script is half the job. Something put it there, so change every password (WordPress admins, hosting, FTP, database), update all plugins and themes, and delete any you do not use. Otherwise it usually comes back within a couple of weeks.
