peter achutha

Hi Samuel Wood (Otto),

Thanks for your reply as I was worried that it was a new feature in WP to have automatic upgrades permanently on. My hosting provider had automatic upgrades turned on permanently as they thought it was important, for security reason, to have the latest version of WP.

Does this mean that others can modify WP commands and syntax without WP approval?

I sent my hosting provider the following message

——– message to hosting provider ————–
As a WordPress developer I have always upgraded my WP sites manually because I cannot allow automatic upgrades when I am in the middle of testing and debugging a feature or a plugin otherwise it will be difficult to find out the correct results. Just imagine that while you are making a pizza someone dumps some ‘liver and kidney’ sauce on your pizza behind your back? You would never be able to figure out what went wrong with your recipe, would you?

It also means that your system is modifying the behavior of WordPress and so is not running to specifications mentioned in the WordPress codex. Please read the WordPress codex to enlighten yourself on what is the WordPress standard that is accepted by everyone https://codex.www.ads-software.com/Configuring_Automatic_Background_Updates.

If your server is planning to come out with their own non-standard version of WordPress you should have let me know before I signed up for hosting on your systems.

I have strictly followed all WordPress rules and laws and have several plugins in their repository and do not want to use a non-standard version of WordPress.

Please understand this as this is very important to all WordPress developers, we only want to use the version supplied by Automattic and not by other third parties.
——— end of message to hosting provider ———

They have now turned off the automatic upgrade override feature and I can return to my software development.

Thanks for the reassurance that it was not WP feature.

Best regards,
Peter Achutha

Bugzilla tech support has just informed me is that “Firefox does only prefetching if there are headers present in the html document.”

Hi mybirchi @mybirchi,

Finally, I have managed to fix the problem. After months of changing and testing PHP code I noticed that if there is ‘bad’ code in the PHP script this problem can get worse. I noticed that when there is a variable that is not set (isset() is false) and you test the variable with an ‘if’ condition the visitor stats shows more visits.

This error notice showed up when my script was getting worse was:-

Notice: Undefined index: 183.78.44.237 in /home/bachutha/public_html/index.php(46) : eval()’d code on line 1070

the code was:
if( $ip == $ipaa[$ip][0] ){ ...

In order to receive this warning I had to add the following code in WordPress index.php at the top.

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

My guess is that was probably why the plugin you mention was causing the problem.

I had asked around in one of the FireFox forums but there was no response. A few days ago I submitted this problem to bugzilla, https://bugzilla.mozilla.org, for reporting bugs in Mozilla products. One of the tech support guys responded, https://bugzilla.mozilla.org/show_bug.cgi?id=1494272, and told me to check https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections.

That was when I found out the FireFox does a prefetch for the next webpage. This prefetch results in two webpages visited instead of one (and messes with my visitor stats).

When I set network.prefetch-next option in Firefox to ‘false’ the second webpage visit disappeared from the stats. Problem solved. I am still monitoring the situation. My guess is that the plugin problem you mentioned may be ‘bad’ PHP code and may be related to the network.prefetch-next option set to true too.

Unfortunately, as I am rushing to get my hacker protection firewall for WordPress up and running, I have not done any tests to confirm that ‘bad’ PHP code will not cause more webpage views when network.prefetch-next option is set to ‘false’.

I hope this helps others too.

• This reply was modified 6 years, 5 months ago by peter achutha.
• This reply was modified 6 years, 5 months ago by peter achutha.
• This reply was modified 6 years, 5 months ago by peter achutha.

Today I decided to confirm that the issue was not related to the database or the plugins. So I deleted my temporary WordPress site and installed the latest version – WordPress version 4.9.6.

I did not install any plugins and created three posts, ‘step-one’, ‘step-two’ and ‘step-three’. The ‘hello-world’ post was not deleted.

Then I used chrome browser and looked at step-one webpage. After that I used FirFox to look at step-two web page.

See the access logs records below (I did not show all the records related to loading of these pages):-

——— access log revords ————

183.78.44.68 – – [20/May/2018:20:54:58 -0700] “GET /mytest/step-one/ HTTP/2.0” 200 57810 “https://drpetersnews.com/mytest/” “Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36”

183.78.44.68 – – [20/May/2018:20:10:18 -0700] “GET /mytest/step-two/ HTTP/2.0” 200 57803 “https://drpetersnews.com/mytest/” “Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0”

183.78.44.68 – – [20/May/2018:20:10:24 -0700] “GET /mytest/step-three/ HTTP/2.0” 200 57294 “https://drpetersnews.com/mytest/step-two/” “Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0”

———- end of records ————-

Chrome show one wep page viewed that is step-one web page, where as FireFox shows two pages viewed – step-two and step-three. It claims that I viewed step-three webpage too.

So it appears that the issue is not related to WordPress plugins or Themes an only to FireFox. Does this mean that if your visitors use FireFox, the search engines will think that your site has twice the number of visitors and improve your ranking?

Today I confirmed that this problem occurs even on other servers. I originally saw the problem on Reseller Panel servers using Hepsia Control Panel but upon testing with InMotion servers using cPanel, the problems still exists. So it does not appear to be server related issue.

I found out that when I use FireFox and viewed the last post, only one post is recorded as viewed. Unfortunately, if I view any earlier post, not the last published post in WordPress, the logs will always show that I viewed two posts.

When I used Opera, Internet Explorer or Chrome, I never had 1 WordPress webpage viewed but 2 recorded in the access logs. So this issue is not replicated using other browsers. It appears to be only a FireFox issue.

If FireFox or WordPress trouble shooting staff need my WordPress database to reproduce my WordPress site on their servers to trouble shoot the problem I am willing to provide it to them.

• This reply was modified 6 years, 10 months ago by peter achutha.

Those plugins I have used are not the cause.

I found out that 1 post viewed but stats shows 2 posts viewed only occurs in FireFox. It does not occur if I use Chrome browser.

I will get back if I have anymore info.

Hi mybirchi (@mybirchi)

Thanks for your help. I found out that you are correct about this (its a database problem) but I have not solved the problem yet. It is still there. If I managed to solve it I will report it here.

I used many database plugins to clear/restore/correct/restore my database and my database size dropped from 8MB to 2MB. Unfortunately, the problem did not go away.

I then tried to install WP version 4.0.0 which I had downloaded many years ago to check if the problem was related to the later versions of WP. Unfortunately, WP would not allow me to run version 4.0 and insisted that I upgrade to version 4.9.2. and WP upgraded the database.

Then I used phpmyadmin to export the WP POST table to an XML file and deleted all of WP (files & database) so that I was starting with a clean slate. I reinstalled WP (version 4.9.2), installed the Twenty Ten Theme and deleted the two records in table WP POST and imported the XML file into this table. Unfortunately that did not work either.

Fortunately, I had kept a copy of an older database when I moved servers. The older database is about 30MB in size. After editing wp-config.php file to use the older database the problem disappeared! Amazing! This ‘confirms’ that it is a database issue or at least related to the WP program accessing the database.

Unfortunately, I do not want to use the older database so I am back to square one.

Will update you later.

Thanks
Peter

• This reply was modified 7 years, 1 month ago by peter achutha.
• This reply was modified 7 years, 1 month ago by peter achutha.

Just to let those reading this know that I found that some themes also create garbage posts. I found this when I was inspecting the WP POSTS database table and noticed garbage posts records which were inserted when I was testing different themes to replace Atahualpa theme.

Beware of the themes you check out.

Hi mybirchi,

I went through the WP Options table and when I was listing all the records (220 records) phpmyadmin gave me a warning:-

Warning: A form on this page has more than 5000 fields. On submission some fields might be ignored due to PHP’s max_input_vars configuration

Does this mean one record was corrupted?

Peter

Hi mybirchi,

Let me correct the previous message. There is a wp options table but I do not know what to check for.

Thanks and best regards,
Peter

Hi mybirchi,

Thanks for your reply as I have been trying to fix this problem for more than a year and failed at it.

I did not understand what you had mentioned.

1. I used phpmyadmin to look at the database but could not find a WP Options data table. Should there be one there or am I looking at the wrong place?

2. I have written 3 of my own plugins but for safety safe and to make it impossible for my plugins to corrupt the database they do not access the database at all. There are only 4 plugins that I used to use. They are Google Sitemap by BestWebSoft which I only activate after I have written a post, SEOPressor which I have deactivated and not used for a few years, SI Captcha Anti-Spam which I have now deactivated and lastly Limit Login Attempts which normally is active but turned off over the last few days to find a solution to this problem.

In this case how would I clear the database as, from experience, some years back the export/import feature does not work properly, so the fear of loss of parts of my web site still keeps the flight or fight response active in me. I hate trying to clean up the database as in my case it has never worked. My sites do get hacked a lot so I have spent many years developing code to block hackers. I did find one post that appeared to be corrupted or missing but I edited the database to clean it up. It has lasted a year now but It has gone missing again. The rest of the posts are in good condition so I dread trying to clean up the database.

This means I do not know how to “You must clear your database and remove unnecessary updation from the WP-OPTION data table via p database access”.

Even with the plugins deactivated I still get the problem. Should I try deleting them one by one?

Thanks for your help and am eagerly waiting for your response.

Hi Judahraine,

Can you show (copy & paste) what ModSecurity log shows when this occured?

Best regards,
Peter

Hi Judahraine,

Are you using the dpaBottomofPostPage plugin. There is no malicious script in this plugin. It must be related to something else. You can check the code yourself or if you do not know PHP let someone who knows PHP check the code.

Check your server if you have ModSecurity installed. Can your host show you the malicious script that was injected?

I have been using this plugin at https://bachutha.com and even though many hackers from Russia, China, Moldova, Germany, France, Turkey, USA, Canada, … are continuously trying to hack my site, my host have not complained about malicious scripts.

Also protect your …/wp-content/uploads/… directory with the following code in the .htaccess file :-

Options -Indexes
DirectoryIndex index.php index.html

#block hackers from these type of files #
# multiple file types
<FilesMatch ".(htaccess|php)$">
 Order Allow,Deny
 Deny from all
</FilesMatch>

This will block hackers inserting and executing PHP code through the /uploads/ subdirectory.

Please let me know how it responds.

Best regards,
Peter

• This reply was modified 7 years, 10 months ago by peter achutha.
• This reply was modified 7 years, 10 months ago by peter achutha.

“But when I refresh the your plugin settings page all of those posts are re-checked again.” Interesting as when I tested for this on my site it was OK. There might be two possibilities I can think of at the moment.

If you have a cache please deactivate it and do the tests.

1. Change you theme to one of the twentyten to twentyseventeen themes and check if you have the same problem. If it does not occur then it could be theme related. What is the theme you are using. I could test it out on my experimental site to see if I get the same problem.

2. Deactivate all your plugins and check if you have the same problem if not then enable the plugins one by one and see if the problem comes back.

The settings are saved in a file and if you refresh the page it will load up the settings that were saved earlier. Unless your server has disabled writing to that file or directory or blocked access to the file. Please do check the permission for the sub-directory on your server at …/wp-content/upload/. They should be 755 and all the files in the sub directory …/wp-content/uploads/dpabottomofpostpage/ should have permission 644

Can you check for me and let me know.

• This reply was modified 8 years, 3 months ago by peter achutha.
• This reply was modified 8 years, 3 months ago by peter achutha.
• This reply was modified 8 years, 3 months ago by peter achutha.
• This reply was modified 8 years, 3 months ago by peter achutha.

Hi wisdomwizard,

I checked selection and unselection of posts and pages on my website https://bachutha.com and refreshed the dpabottomofpostpage menu page and they stayed checked or unchecked after I changed the settings. If that was you problem.

Alternatively if you website did not show the changes in the settings, my only suspicion as to why refreshing the page on your site did not show the changes is that you may have a cache that is not updated. Please clear the cache and then new settings should show on your website.

Please let me know if this works for you.

• This reply was modified 8 years, 3 months ago by peter achutha.