I have a few sites hosted on a Digital Ocean Cloudways server, only two sites are production sites.

We started experiencing full CPU usage and had these spikes often, it’s been happening for over a month. Spoke to Cloudways support constantly, they just said they changed things on their end and it would go down and then go up and again and stay there near constantly which slowed down everything, we couldn’t edit pages and visitors speed was slow as well. Today I started digging around in the folders and found the below, which I thought is suspicious. I’m more frontend strong, so this is not really my super skill but I want to learn and I really want to make sure I clean up whatever is going on here.

Found in wp-config:
if (!defined("RSSSL_HEADERS_ACTIVE") && file_exists( ABSPATH . "wp-content/advanced-headers.php")) {
require_once ABSPATH . "wp-content/advanced-headers.php";
}

/* That's all, stop editing! Happy blogging. /
/* Absolute path to the WordPress directory. /
if ( !defined('ABSPATH') )
define('ABSPATH', dirname(FILE) . '/');
/* Sets up WordPress vars and included files. */
require_once(ABSPATH . 'wp-settings.php');

.user.ini file:
; BEGIN Really Simple Auto Prepend File
;auto_prepend_file = '/public_html/wp-content/advanced-headers.php'
; END Really Simple Auto Prepend File

.htaccess:

Begin Really Simple Auto Prepend File

<IfModule mod_php7.e
php_value auto_prepend_file /public_html/wp-content/advanced-headers.php
</IfModule>
<IfModule mod_php.c>
php_value auto_prepend_file /public_html/wp-content/advanced-headers.php
</IfModule>

You can find the contents of the advanced-headers.php file – https://file.io/jGkd5v99V66P

And then I found two Wordfence Security Activator plugin folders, but one had a number added to the name. Both showed up on the plugin dashboard but one was deactivated.

Is my suspicions correct? I’m wondering if anyone else has seen this. I’ve scoured the internet.