Matthew

You can try resetting Wordfence.

https://www.wordfence.com/help/advanced/remove-or-reset/

Jetpack is a plugin of Automattic, which is wordpress.com; a separate entity of the open-source project of www.ads-software.com.

I would suggest reaching out to wordpress.com or try getting support here https://jetpackme.wordpress.com/contact-support/

I use FileZilla and SCP (https://linux.die.net/man/1/scp)

scp - secure copy (remote file copy program)

scp copies files between hosts on a network. It uses ssh(1) for data transfer, and uses the same authentication and provides the same security as ssh(1).

Have you created a child-theme? Doing so will keep any changes you’ve made to the functions.php file.

https://developer.www.ads-software.com/themes/advanced-topics/child-themes/

I would imagine there is some kind of redirect that is setup somewhere within the site that’s causing this.

You may want to check any redirection plugins and possibly temporarily disable them one-by-one to see if one is causing this issue.

I’m seeing the following redirect when curling a page:

curl -sIL "https://banghenhomduc.com.vn/gioi-thieu-ve-nhom-duc-faco/"
HTTP/2 301
date: Mon, 22 Feb 2021 22:45:46 GMT
server: Apache/2
x-powered-by: PHP/7.4.10
x-redirect-by: WordPress
location: https://banghenhomduc.com.vn/
vary: User-Agent
content-type: text/html; charset=UTF-8

HTTP/2 200
date: Mon, 22 Feb 2021 22:45:47 GMT
server: Apache/2
x-powered-by: PHP/7.4.10
link: <https://banghenhomduc.com.vn/wp-json/>; rel=&quot;https://api.w.org/&quot;, <https://banghenhomduc.com.vn/>; rel=shortlink
vary: User-Agent
content-type: text/html; charset=UTF-8
curl -sIL &quot;https://banghenhomduc.com.vn/gioi-thieu-ve-nhom-duc-faco/?cachebust&quot;
HTTP/2 301
date: Mon, 22 Feb 2021 22:45:55 GMT
server: Apache/2
x-powered-by: PHP/7.4.10
x-redirect-by: WordPress
location: https://banghenhomduc.com.vn/?cachebust
vary: User-Agent
content-type: text/html; charset=UTF-8

HTTP/2 200
date: Mon, 22 Feb 2021 22:45:57 GMT
server: Apache/2
x-powered-by: PHP/7.4.10
link: <https://banghenhomduc.com.vn/wp-json/>; rel=&quot;https://api.w.org/&quot;, <https://banghenhomduc.com.vn/>; rel=shortlink
vary: User-Agent
content-type: text/html; charset=UTF-8


		
	

Hello, it doesn’t look like the domain is behind Cloudflare. Setting up the domain behind Cloudflare, even the free plan, will provide benefits to site. https://cloudflare.com

I would not consider the issue over as there are most likely compromised files still present on the site/server.

You’ll want to have a look at and follow this article https://www.ads-software.com/support/article/faq-my-site-was-hacked/

And then possibly look at implementing some of the guidelines here https://www.ads-software.com/support/article/hardening-wordpress/

I hope this helps and good luck!

Those appear to be date/time in epoch. I’m not too sure why it’s getting logged, unfortunately. It’s probably best to contact the hosting provider’s support.

I’m coming in to also suggest a search/replace and provide some helpful articles for you.

Please check https://www.godaddy.com/help/find-and-replace-with-a-wordpress-plugin-26399 and https://www.godaddy.com/help/database-find-and-replace-26404 prior to performing this.

Hope these help!

You may want to try enabling WordPress debugging to see where this might be stemming from.

The following defines would need to be added to the **wp-config.php** file above /* That's all, stop editing! Happy publishing. */:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );

You can find out more about WordPress debugging and logging with the official WordPress Org Codex. https://codex.www.ads-software.com/WP_DEBUG

Some additional documentation on parse errors: https://www.ads-software.com/support/article/common-wordpress-errors/#parse-errors

>You can also include define( 'WP_DEBUG_DISPLAY', false ); to keep errors and warnings from disabling on the front-end of the site.

I would also recommend reaching out to the web hosting support to check the PHP error log for any further pertinent information.

Hope this helps!

Hello,

You may want to try posting this in https://www.ads-software.com/support/theme/storefront/ since Boutique is a Child Theme of Storefront.

Hello there!

Did you restore the files as well or just the database? From the context, it seems like you had only restored the database.

That is indeed looking like a Nexcess address. I would encourage you to reach out to Nexcess support.

You can check email headers to try to see if the source is a valid sender. https://support.google.com/mail/answer/29436?hl=en but as I originally mentioned, please contact your WebHost if you have any concerns. They’ll most likely request the email headers so it’s good to know where to find those anyway.

Hope this helps and kind regards.

Hello, I haven’t used this myself but it might be something for you to try out https://www.wpbeginner.com/wp-tutorials/how-to-organize-wordpress-files-in-media-library-folders/

This takes you through using https://www.ads-software.com/plugins/media-library-plus/

Hope this somewhat helps!

Hello,

It looks like those URLs are using GoDaddy’s cdn/caching system. You may want to try purging all site cache to see if this helps. I’ve found this for you https://www.godaddy.com/help/clear-your-cache-12444

I’m also seeing a 502 occurring:

curl -sIL https://secureservercdn.net
HTTP/2 502
server: nginx
date: Fri, 22 Jan 2021 18:00:52 GMT
content-type: text/html
x-sucuri-id: 20036
x-sucuri-cache: MISS

It’s possible something may be going on with the CDN. It would behoove you to reach out to GoDaddy’s support if you haven’t already.