Hostarmada injects hidden code into wordpress installs
I signed up expecting reliable cloud and safe hosting with clean wordpress installs. Instead, I discovered that hostarmada injects hidden code into wp-config.php and adds a custom ha-custom.php file after installing a load of unwanted plugins, without any notice or permission. This broke basic wordpress functionality like xml output, and only after hours of debugging, where support was quick to blame SEOpress, (and a second manual install) did I find out the issue was hostarmada’s own internal setup. Technical support confirmed this is done on purpose and cannot be disabled. Instead pushed an overpriced VPS product because I ask for a clean Wordpress installation without any code injected into core files. This is a clear violation of wordpress.org best practices, and it makes the platform unreliable and unsafe for anyone who expects clean, functional Wordpress hosting. I’ve now moved my websites away and requested a refund under the 45-day money-back guarantee. Update 2: Since Hostarmada is trying every gaslighting trick to deny the validity of this review, this is the context to which Philip responded and confirmed the existence of unsollicited code injection into core Wordpress files: “ Hi, I did find the source and fixed the problem, which is very much related to my earlier ticket about Softaculous installing a random bunch of without my permission or without me asking for it. in wp-content there is ha-custom.php that refers to all the plugins that got installed Softaculous. Removing the file creates a Wordpress fatal error pointing to this line in the wp-config file: require_once ABSPATH . 'wp-content/ha-custom.php'; Removing that line resolves the fatal error and the xml problem. I don't know why Hostarmada still forces a random bunch of plugins on empty Wordpress installs, then inserts custom code into critical Wordpress files that render normal website/Wordpress functions unusable... and I even know less why the first response is to point at SEOpress to solve the problem when the plugin is not at fault here... But it's clear now that the problem is caused by Hostarmada and this all now makes me think actively of using the 45 day money back guarantee... since I lost trust in that my websites can function safely and correctly on Hostarmada servers.” Update: Hostarmada is demanding the review to be removed, and flagged it for having false information. It’s a shame I cannot add screenshots, but these are 1-1 copies from the response I got from Philip: “The file that you have found and that has been added to your installation is from a custom internal configuration of HostArmada - at this point, it cannot be removed/excluded when installation from Softaculous is performed. I understand that in some cases, it may introduce issues like the one explained in your ticket, but after a consultation with our system administrators, I am afraid that we cannot disable it per account/user. With that in mind, you can manually remove the file and the includes inside the wp-config.php file after you perform an installation, so it will not cause any further issues. If you want this to be fully removed and such manual interventions to be avoided after each installation, then I will recommend considering a VPS server where we can tweak the environment the way you want:“ I do understand that Hostarmada prefers to keep this a secret, but their own tech support confirmed the existence, no matter how much misleading and gaslighting answers they try to spread. Update 24-07-2026: Hostarmada again abused the Trustpilot system by falsely flagging a legitimate review trying to get it removed and hide the truth.