that won't do. the script has been renamed in a lot of themes it has been included in. try something like: $ grep -rH "(strpos (strtolower ($url_info" /pat

that won't do. the script has been renamed in a lot of themes it has been included in. try something like: $ grep -rH "(strpos (strtolower ($url_info" /path/to/wordpress if you are auditing PHP code, strpos is good to look out for, since it is often misused such as the case here. strpos will evaluate to true is the needle is match anywhere in the haystack, so things like: if(strpos(strtolower($username), 'admin')) will match username 'test.admin' etc.