miguelkennedy

Same situation here.

v1.5 completely broke my sites. Had to manually downgrade to v1.4.9 ??

• This reply was modified 2 months, 4 weeks ago by miguelkennedy.

I found that one of my admin users had an application password set up by the malware. I think this might be the attack vector.

Go to the user’s menu on WP and go to edit mode of each administrator user. Check if an application password is set. If it is, delete it.

I couldn’t delete mine through the WP dashboard, I had to do it directly from the database. Maybe you’ll face a similar problem.

Hope this helps

• This reply was modified 4 months ago by miguelkennedy.

Thanks, Evotec.

Worked perfectly! ??

I managed to resolve this issue by terminating my account with SiteGround and building my own nginx server from scratch using a Linode box. I’m using nginx with varnish for caching and also use HHVM. In case HHVM crashes the server fallbacks automatically to PHP7. In case PHP7 crashes it falls back automatically to PHP5.6.

HHVM works everywhere in my Woocommerce site and I have around 100 plugins… The problem is SiteGround, not HHVM.

Also, since terminating my SiteGround account and building my own server from sratch my site is, at least, 20x faster and wayyyyy cheaper..

No worries, Rene ??

Thanks for making such great plugin. I use it daily!

That’s easy.

In your main site, go to WP Staging menu page (where you created your staging site). In there you will see your staging site listed and you have the option to delete it. It will delete the files and the database tables for that staging site

Hi, adminunoia.

In your nginx config file for your site, usually located at /etc/nginx/sites-available or /etc/nginx/sites-enabled.

Your need to write the code I posted above inside your server { } block in that config file… NAME_OF_STAGING_FOLDER should be the name you gave to your staging site when you created it with WP Staging plugin.

nginx.conf is the main config file for nginx… You should not write the code in this file, instead you write it in the config file specific to your site. Check the folder locations I wrote above.

Hope this helps.

Nevermind, managed to get it working by adding the following lines in my nginx site config file

location /NAME_OF_STAGING_FOLDER {
index index.html index.htm index.php;
try_files $uri $uri/ /NAME_OF_STAGING_FOLDER/index.php?$args;
}

Note: Change NAME_OF_STAGING_FOLDER with the actual name of your staging site’s folder

@ jedmccarthy

Are you using SiteGround hosting?

Thank you so much for the time you took to provide me with support! Managed to get it working.

My server uses HHVM but if HHVM fails it fallsback to PHP7 and if that fails it fallsback to PHP5.6…

The firewall is working in all versions of PHP and HHVM… nice ??

One last question… Will the firewall work with varnish? I’m using varnish to cache full pages…

Nginx is in front of varnish acting as a proxy so https request -> nginx -> varnish -> nginx -> browser

Do I need to insert any special parameter in /etc/hhvm/php.ini?

Rene, no problem ??

I was going to say the same thing about the permissions security risks…

edpirone, here’s what I recomend:

1) Go here https://gist.github.com/Adirael/3383404 and click the “Download ZIP” button.
2) Unzip the file, open the sh file with notepad (if you’re on windows) or textmate if you’re on mac).
3) Change WP_ROOT=$1 to WP_ROOT=/var/www/vhosts/sharphat.com/httpdocs/
4) Save the file

I’m going to assume you’re on a Linux/Ubuntu server. If not, let me nknow.

5) FTP to your server with root and place the sh file in /usr/local/etc/

Now you need to login to your server with SSH… If you have root access then you should have SSH access as well.

Once you’re logged in with SSH type the following command:

sudo /bin/bash /usr/local/etc/fix-wordpress-permissions.sh

It will take at least 1-2 minutes to run and you’ll have ALL files and folders of your wordpress installation with correct permissions based on recommendations
from https://codex.www.ads-software.com/Hardening_WordPress#File_permissions

Do this as soon as possible because you’re site is currently at risk. Never give full 777 permissions to an entire site.

Hope this helps

edpirone… DId it work? Are you able to make staging sites with wp-staging plugin?

Logs didn’t show anything but I found the culprit.

In Redis config file unixsocketperm 755 should be unixsocketperm 777 otherwise the plugin can’t connect through UNIX sock.

Now everything is working fine ??

https://askubuntu.com/questions/14763/where-are-the-apache-and-php-log-files