jca

Yes, I installed “Exclusive Addons for Elementor” plugin.

No, I did not install “ShopCred” plugin.

I believe the “Exclusive Addons for Elementor” plugin acquired my email address (after deactivating/uninstall) and sent me unsolicited email about this unrelated plugin. My review above says: “I’ve never used this plugin before.”

@jdembowski if my review of either plugin needs to be modified or removed per www.ads-software.com guidelines, please do so.

Remove any spaces after “?>” at the very end of the document.

This didn’t fix the problem for me.

Are we talking about the same issue? You mentioned using your Firefox RSS reader — we’re talking about seeing the RSS feed in a Admin Dashboard widget.

Does the WordPress Codex need to be updated so it isn’t “advocating fake pretend security”?

I have WordPress 2.7 installed on a different host/server, and it has no problem with the Other WordPress News widget using the planet.www.ads-software.com feed.

I tried burning the planet.www.ads-software.com to a Feedburner feed to see if that version would load, but it made no difference.

Could this may be a problem with the web host (which is Dreamhost, in this case)?

Any ideas?

Tried the fix mentioned in another thread here which seemed to work:

Rename index.php to index.html in the /wp-content/plugins/ folder.

I have the same blank page problem via the index.php?page=index.php Dashboard link as well.

Sigh. If you think that “hiding” things is “more secure” then we really have nothing to discuss.

Otto42, I’m sorry if you are annoyed with my question(s) about “fake pretend security”. Thanks for taking the time to explain these misconceptions about security, wordpress, etc.

If anyone knows how to exclude specific wp-admin files/folders/etc. from htpasswd, please let me know, I’d appreciate it.

Recommended by who, exactly?

Just one of many security tips offered by various sites to protect WordPress. Aren’t there WP plugins that also password protect the wp-admin folder?

I wouldn’t think adding another layer of security to the wp-admin folder is a waste of time. With the popularity of WordPress and it being a target of hackers, how could advocating more security ever be a bad thing?

If for example, someone got the WP admin login and password (by whatever method), they wouldn’t necessarily have the htaccess password and vice versa.

How is this a bad thing?

And the files in wp-admin do not necessarily all need to be hidden from the users in some way.

Wouldn’t calling files from the wp-admin folder for public page loads prevent other security measures/ideas, such as renaming the wp-admin folder to hide it from attackers, like vBulletin allows you to do?

Regardless, if anyone knows how to exclude files from .htpasswd via the .htaccess file, please let me know.

Just wanted to echo the failed login with Dreamhost problem… Do problems/issues with that web host ever end?

Looks like it was the “ro8kfbswmag.txt” exploit:

https://www.ads-software.com/support/topic/141041

I’m repairing some of the damage now via MyPHPAdmin, but still can’t get back into the admin panel because of the previously mentioned version error. I see no wp_options SQL table setting for wordpress version numbers. Am I missing it?

I’m assuming the spam is following because plug-ins (like akismet and captcha) have been disabled – hard to say since I can’t get into the admin panel.

And thanks for the help with the out-of-date WP install reminder. I’m aware of that, but haven’t been able to upgrade for unrelated reasons. If you have any advice or help, it would be appreciated.

jporadek: Thanks, I appreciate the kind words. ??

I’m glad it seems to be working in IE and FF on the PC. Although, I’m sure the fixed background image in the entries isn’t working quite right since IE 6 doesn’t know how to handle fixed image backgrounds (it insists on scrolling them) in divs. Let me know if you see any glitches or other gotchas.