mpek

Had the same issue on two sites.
Patch works! Thank you for fast turnaround.

This would be very good if implemented.

Hi Tim,

thank you for looking into it!

This file (1owl.php) has nothing to do with me and I deleted it. They added the file to two of my websites:

[Sites are mentioned in email]

It is more a malicious attempt to steal traffic from my site or game a SEO boost.

My main question is how they were able to place the file in root directories of my wordpress installations and why wordfence blocked my site from showing.

Thank you for further investigating. File sent!

This is what Wordfence scan showed:

• This reply was modified 3 years, 4 months ago by mpek.

I deleted the mentioned entries in .htaccess, because i could not wait any longer to find the .user.ini file you mentioned. After that I could access the site again and re-initialize wordfence and add entries back to .htaccess by using wordfence function in settings. Site works again.

To look for .user.ini file took some time, but .htaccess was the file in my case.

If you want to further investigate what happened, please contact, because Wordfence found a suspicious file called 1owl.php.
This seemes to be a backdoor, but I don’t where it came from and how it could be placed there.

I’m using Filezilla and turned on to show hidden files, “Force showing hidden files” is ticked now.

Checking root directory, i don’t see that “.user.ini” nor “php.ini” in root directory of this wordpress installation.

The file browser of my hosting control is not showing these files neither.

Just to exclude misunderstandings, root directory is where you see these directories:
wp-admin
wp-content
wp-includes

Correct?

Hi Tim,

thank you for your reply!

I cannot find a file “.user.ini”, I even checked my other wordpress installations, but there is none.

“.user.ini” is being mentioned in file “.htaccess”

This is what I found in file .htaccess regarding Wordfence:

`# Wordfence WAF
<IfModule mod_php5.c>
php_value auto_prepend_file ‘/home/www/sitename/wordfence-waf.php’
</IfModule>
<IfModule mod_php7.c>
php_value auto_prepend_file ‘/home/www/sitename/wordfence-waf.php’
</IfModule>
<Files “.user.ini”>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>

# END Wordfence WAF`

Any hint?

Not often, but we could try. If you want you could log in yourself, it’s a demosite, but because of admin rights I’d send you login credentials

Thanks for your quick response.

I put in the short code that shows next to

Code to insert on a WordPress page to see Weekly Schedule

That is:

[weekly-schedule schedule=1]

Screenshot 1

Screenshot 2

Screenshot 3

PHP 8 is not supported yet. You are too early.

Well, annotaions don’t exist anymore on YouTube. I assumed that your player is capable to save annotations by a viewer at time stamps, so that someone else seeing the video with these annotaions the first viewer left there. Thank you for your answer.

Can you do this for me?

Sent out Reply emails to tickets are empty as well!

That’s quick to answer. It’s PHP version 7.0.