Vanderlindemedia

I think it’s your server dude. I have deployed Litespeed cache over 260+ wordpress websites, and have a license on the Litespeed enterprise edition. To be fair it offers far more performance and uptime benefits then anything else.

Perhaps you should dive into a few things first before using it. It’s experimental (the advanced part) but widely adopted at this point.

wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:142
DOMDocument->loadHTML()
wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:142
DOMUtilForWebP\PictureTags::getAttributes()
wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:201
DOMUtilForWebP\PictureTags->replaceCallback()
wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:201
preg_replace_callback()
wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:323
DOMUtilForWebP\PictureTags->replaceHtml()
wp-content/plugins/webp-express/vendor/rosell-dk/dom-util-for-webp/src/PictureTags.php:335
DOMUtilForWebP\PictureTags::replace()
wp-content/plugins/webp-express/lib/classes/AlterHtmlInit.php:57
WebPExpress\AlterHtmlInit::alterHtml()
wp-content/plugins/webp-express/lib/classes/AlterHtmlInit.php:57
ob_end_flush()
wp-includes/functions.php:5427
wp_ob_end_flush_all()
wp-includes/class-wp-hook.php:324
do_action('shutdown')
wp-includes/load.php:1280
shutdown_action_hook()
wp-includes/load.php:1280

DOMDocument::loadHTML(): htmlParseEntityRef: expecting ';' in Entity, line: 6

Hi,

after deleting of above plugin, the creation of new admin accounts has stopped. There’s numerous login attempts through invalid names (users that have bin deleted before) and any of the new hacks are not happening again.

In regards of a plugin being installed by client or someone who was helping the client, i.e nulled software with potential backdoors, yes that might be a scene. But it’s suspicious after deleting the plugin, the hacks stopped completely. Perhaps there is a security vulnerability that you or me don’t know about.

Once you can upload a file, you can execute certain commands, thus reading the database, plus inserting users into the database which grants them admin rights.

So please, double check your plugin, perhaps outdated, old or vulnerable files.

I think i got it solved,

Known bot patterns where set to throw a JS challenge. That prevented the plugin to communicate.

2nd website same cause. Huge delay in switching from page to page. Once i crammed above up in functions.php followed with the CSS disable of Gutenberg, things are rapid and fast again.

It is unbelievable how this product turned into a commercial and bloated package. Also the pushing of Twenty*something theme upon every update is stupid. Then woocommerce that ramps up 20k rows of “finished crons” that you also have to cut to a limited 3 days on avg before the database runs into the GB’s territory.

Its like we need more servers these days to run something once simple as wordpress. I’m not a fan of constant calls beind made while users clicks away in Admin. If the service on the other end gets down or slow so does the wp-admin will in this case.

Ill just have to hack the larger shops i guess to stop making callbacks, check for updates and what more. I dont need a security plugin, i have server security running on server level. That is 10x more effective then a plugin which can be simply bypassed by targetting JS files outside of wordpress.

Please note, with entering above code, you are also disabling the need for update(s) or check. It makes it look like everything is updated and no new files are available, but this is more of a expert setting.

We do use certain server sided checking for XSS exploits and such.

Add an option then “Integrate in admin bar” so users can choose or pick. I manage 2700 websites or so. I often as a extra service update and test the whole thing for various clients. This is just time robbing when websites do chrash and the wp-admin cant be accessed.

Why not integrate it into the admin toolbar. Works for litespeed. And solves future issues with updates.

Yeah and that leaves us in a loop, also if you hard type wp-admin/admin.php?page=litespeed-db_optm for example.

But there is’nt a way to hard flush using wordpress admin toolbar button itself?

Directadmin integration. I’m able to create redis instances or delete m, have to alter wp-config with the login details and port number, and thats it.

And how do we do that without SSH access to redis object cache? Reboot is’nt an option with 400 days of a uptime.

4th site now in a loop.

I think it’s best to add a button to the admin bar to “clear” or “flush” the redis object cache.

It requires me to completely delete and re-install the plugin again to “avoid” the above error.

Edit; keeps looping back and forth to wp-admin/upgrade.php?_wp_http_referer=%2Fwp-admin%2F

Basicly, when i activate / connect Redis the product itself goes out of stock. This appears as well when i completely disable litespeed caching. So it’s 100% redis here that does’nt go along well.