website migration files quarantined after Dev Server went live

[Michael]

I’m check wpconfig.php myself, there aren’t any changes in it unless it hidden in hexidecimal.

[Michael]

public_html/wp-content/themes/Avada-Child-Theme/fpdf/Withdrawal_Form.pdf: This file is my own custom code generating a PDF from a user form.

public_html/.htaccess  – I think I already encrypted this file and set it to protected

/public_html/wp-content/db.php  –  I have no idea why this is coming up last night for the first time.

 

 

[Michael]

This is /wp-content/db.php (it appears to be part of W3 Cache)

PS I already followed BPS instructions to rerun the Pre & SetUp Wizard to account for W3Cs presence in htaccess.

<?php

/**
* W3 Total Cache Database module
*/
if ( !defined( 'ABSPATH' ) ) {
die();
}

if ( !defined( 'W3TC_DIR' ) ) {
define( 'W3TC_DIR', ( defined( 'WP_PLUGIN_DIR' ) ? WP_PLUGIN_DIR : WP_CONTENT_DIR . '/plugins' ) . '/w3-total-cache' );
}

/**
* Abort W3TC loading if WordPress is upgrading
*/
if ( !@is_dir( W3TC_DIR ) || !file_exists( W3TC_DIR . '/w3-total-cache-api.php' ) ) {
if ( !defined( 'WP_ADMIN' ) ) { // lets don't show error on front end
require_once ABSPATH . WPINC . '/wp-db.php';
} else {
echo sprintf( 'W3 Total Cache Error: some files appear to be missing or out of place. Please re-install plugin or remove %s. <br />', __FILE__ );
}
} else {
require_once W3TC_DIR . '/w3-total-cache-api.php';

// no caching during activation
$is_installing = ( defined( 'WP_INSTALLING' ) && WP_INSTALLING );

$config = \W3TC\Dispatcher::config();
if ( ( !$is_installing && $config->get_boolean( 'dbcache.enabled' ) ) || \W3TC\Util_Environment::is_dbcluster() ) {
if ( defined( 'DB_TYPE' ) ) {
$db_driver_path = sprintf( '%s/Db/%s.php', W3TC_LIB_DIR, DB_TYPE );

if ( file_exists( $db_driver_path ) ) {
require_once $db_driver_path;
} else {
die( sprintf( 'W3 Total Cache Error: database driver doesn\'t exist: %s.', $db_driver_path ) );
}
}

$GLOBALS['wpdb'] = \W3TC\DbCache_Wpdb::instance();
}
}

[AITpro Admin]

There is no such thing as false negatives or false positives with BPS Pro AutoRestore|Quarantine.  At this point, please provide us with a WordPress Administrator login to your website so we can figure out the problem.  We don’t know if these are procedural mistakes or if there is actually a problem with your particular website/host.  Send a WordPress Administrator login to your site to this email address: info at ait-pro dot com.

[AITpro Admin]

I got this far before your web host lost its mind…

Created an AutoRestore single file exclude rule for this file since it is dynamically created/updated.
/home/thscorgt/public_html/wp-content/themes/Avada-Child-Theme/fpdf/Withdrawal_Form.pdf

Created an AutoRestore single file exclude rule for this file since it is dynamically created/updated.
/home/thscorgt/public_html/wp-content/db.php

Help Reference Link: http://forum.ait-pro.com/forums/topic/autorestore-quarantine-guide-read-me-first/#autorestore-exclude-rules

PHP Error Log Path Does Not Match:
There is some new issue occurring with BPS Pro ini_set Options not being added to the wp-config.php file on Setup Wizard run.
We are looking into the problem to try and figure out why this problem all of sudden starting occurring recently.
Manually added the placeholders in your wp-config.php file and ini_set Options work fine now.
Your PHP Error Log path is now set correctly.

A plugin or your theme is incorrectly writing log entries to your php error log.
The php error log is only for logging php errors and not a personal log for plugins and themes.
The log entries are happening very frequently.
[16-Sep-2019 20:03:19 UTC] 3
[16-Sep-2019 20:04:03 UTC] 3
[16-Sep-2019 20:04:19 UTC] 3
[16-Sep-2019 20:04:27 UTC] 3
[16-Sep-2019 20:04:31 UTC] 3
[16-Sep-2019 20:05:36 UTC] 3
[16-Sep-2019 20:05:37 UTC] 3
[16-Sep-2019 20:05:39 UTC] 3
[16-Sep-2019 20:05:49 UTC] 3

Your Root htaccess file (auto_.htaccess) is being repeatedly quarantined for these reasons:
#1. You need to lock your root htaccess file on the B-Core > htaccess File Editor tab page. Unfortunately, your particular web host does not allow locking the root htaccess file.
The reason for that is other plugins and themes will either flush the root htaccess file incorrectly or write new htaccess code
to the root htaccess file.

#2. You need to use BPS Pro Custom Code instead of allowing your Root htaccess file to be unlocked.
In your case W3TC was writing htaccess code at the bottom of your root htaccess file.
BPS Pro has a feature called Setup Wizard AutoFix, which automatically sets up W3TC and adds W3TC caching code into BPS Custom Cod.
This issue is now fixed by re-running the Setup Wizard.
Note: If you change your W3TC caching plugin settings at a later time then you need to re-run the Setup Wizard.

W3 Total Cache (W3TC) htaccess code was not found in your Root htaccess file
If you have deactivated Root Folder BulletProof Mode temporarily then disregard this message. When you activate Root Folder BulletProof Mode again this message will go away automatically.
Or you can run the BPS Pre-Installation Wizard and Setup Wizard now to make this message go away now.
If you just installed W3 Total Cache then go to the W3TC plugin settings page, choose and save the W3TC plugin settings that you want to use and then run the BPS Pre-Installation Wizard and Setup Wizard to automatically setup/combine W3TC and BPS htaccess code together.

I locked your root htaccess file and your website no longer loads due to your web host – “denying access to be safe”.
Your web host displays this error message below instead of your website. hmm not such a good security measure since
basically your web host takes your website down by doing this.

Forbidden
You don’t have permission to access / on this server.
Server unable to read htaccess file, denying access to be safe

We have added a solution in BPS Pro for this type of problem scenario and that is to create a single file exclude rule for your root htaccess file in AutoRestore.

[AITpro Admin]

I sent you an email to delete your root htaccess file so that your web host no longer takes your website down.  Currently your website is down due to your web host.

[Michael]

Host support is asking this question:

Have you added any security plugin that might cause the .htaccess file to be disabled?

[Michael]

BPS is blocking the .htaccess

[AITpro Admin]

Your website is back up.  Nope, this problem was caused by your web host.  Yes, I locked the root htaccess file, but instead of your web host doing something logical like automatically blocking that or automatically changing the root htaccess file permissions back to 644 they instead took down your website with this error message below. Yeah not so brilliant.  They basically hack your website by using that “security measure”.  LOL

Forbidden
You don’t have permission to access / on this server.
Server unable to read htaccess file, denying access to be safe

[Michael]

While you were working WPX started blocked our .htaccess file,
I suggested they back it up and remake a default .htaccess file and that fixed the problem.

[Michael]

Well they are trying to protect us as well, you and them are like two Internet Security Suites in competition.

[Michael]

This is what the host says about the outage:

Can you help me understand why WPX blocked the htaccess?
Georgi Katsov 16:05
We did not block the htaccess file.
The security plugin sets rules in the htaccess file that forbids access to it.
Michael 16:06
I tried disabling the plugin folder and the htaccess was still blocked
Georgi Katsov 16:07
Yes disabling the plugin won’t remove the rules.
Michael 16:07
Your saying that was a file level permission rule such as 664
Read
Georgi Katsov 16:08
Yes also adds rules as code in the htaccess file as well that make changes to the site.
Georgi Katsov 16:09
Normally the plugin forbids access so you don’t get hacked but sometimes that crashes the WordPress itself.

[AITpro Admin]

While you were working WPX started blocked our .htaccess file,
I suggested they back it up and remake a default .htaccess file and that fixed the problem.

Yes, that fixed the problem they created – crashing your website. Brilliant security measure. NOT LOL

Well they are trying to protect us as well, you and them are like two Internet Security Suites in competition.

Hmm nope BPS Pro cannot be compared to your web host’s “security measure” if you want to call it that. LOL BPS Pro can cause a site to crash in certain cases, but that is due to an error or problem and not done intentionally vs your web host intentionally taking your website down as a “security measure”???

The chat is interesting, but completely useless. What happened is this. I locked your root htaccess file and your web host launched a nuke at your website and obliterated it. Brilliant stuff. NOT LOL

Here are the rest of the things I fixed and you have 1 problem to deal with – continuous php errors (see explanation below).

A plugin or your theme is incorrectly writing log entries to your php error log.
The php error log is only for logging php errors and not a personal log for plugins and themes.
The log entries are happening very frequently.
You will need to deactivate your plugins one by one to find which plugin is doing this.
It could be your theme, but eliminate all of your plugins first.

[16-Sep-2019 20:03:19 UTC] 3
[16-Sep-2019 20:04:03 UTC] 3
[16-Sep-2019 20:04:19 UTC] 3
[16-Sep-2019 20:04:27 UTC] 3
[16-Sep-2019 20:04:31 UTC] 3
[16-Sep-2019 20:05:36 UTC] 3
[16-Sep-2019 20:05:37 UTC] 3
[16-Sep-2019 20:05:39 UTC] 3
[16-Sep-2019 20:05:49 UTC] 3

Your wp-config.php file did not contain Salt phrases, which I have now added/fixed.

define( ‘AUTH_KEY’, ‘put your unique phrase here’ );
define( ‘SECURE_AUTH_KEY’, ‘put your unique phrase here’ );
define( ‘LOGGED_IN_KEY’, ‘put your unique phrase here’ );
define( ‘NONCE_KEY’, ‘put your unique phrase here’ );
define( ‘AUTH_SALT’, ‘put your unique phrase here’ );
define( ‘SECURE_AUTH_SALT’, ‘put your unique phrase here’ );
define( ‘LOGGED_IN_SALT’, ‘put your unique phrase here’ );
define( ‘NONCE_SALT’, ‘put your unique phrase here’ );

This htaccess code is being automatically added to your root htaccess file which triggers AutoRestore to quarantine your root htaccess file.
I have added this htaccess code below in BPS Custom Code.
I have also created a single file exclude rule for the root htaccess file in AutoRestore.
# BEGIN ShortPixelWebp

# END ShortPixelWebp

The wp-config.php file quarantine problem was most likely caused by adding W3TC code in the wp-config.php file or RSSL code in the wp-config.php file.
Most likely when W3TC added its code in the wp-config.php file and the dependent db.php file was missing due to being quarantined then your site crashed.

In summary, the problems were a mix of your particular web hosts limitations, some plugins doing whacky and stupid things that they do and some general nuisance types of issues going on.
All problems should be resolved at this point with the exception of the plugin that is using your php error log as a personal log for whichever plugin is doing that idiotic thing.
A good time was had by all. LOL

[Michael]

Thanks for all the help on this long thread.
I’m still catching up on sleep from our launch last Friday, and haven’t really had time to study the BPS Dashboard with my pile of tasks.

Where are you seeing the PHP error log?
My host is saying that they don’t see the same errors that you see, but instead, are show me this screenshot of their error log:
https://monosnap.com/file/JWpsVoIUGG1ttXtjWezMtDFxUsDlmC

[Michael]

Your looking at PHP Errors through Cron jobs, because your looking in the folders only the host admins have access to.
However they provide me with an error log produced from their dashboard and it primarily shows me errors from BPS.

[Author]

Posts