Hi,
There seems to be a major issue with my site running Newspaper version 12.7. At the moment the theme is showing correcly in backend , but not in the frontend
.
All plugins are active. But there is another issue that might be the cullpritt.
It looked like somehow my site was hacked on April 8. I found the following files and folders in my wp root directory:
alexusMailer_v2.0.html; alexusMailer_v2.0.php; iub.zip; red.zip; iub (folder) and tomy (folder)
The process for mariadb also gets killed almost every day.
I removed mentioned files and folders and checked for unknown users, also in the users table through phpMyAdmin. Also checked table options, witch has a lot of autoload rules, some of wich I can not identify with a plugin.
I am running my website on a Apache Linux VPS server, with 60GB RAM and 16 CPU cores. My database is about 3,1GB large at the moment. It is a newssite with daily new content (about 20 articles with featured images). Images are served through a plugin from Google Drive.
Since my website is my income, it is quite important that a solution can be found. I am willing to pay for professional help ofcourse if that is at all possible, but my budget is not immense.
Anny help is appreciated. Please let me know if you need details for wp, ftp etc.
Image backend see https://imgur.com/syxLKfB
Image frontend see https://imgur.com/cZZvgvr
Update: I tried reinstalling theme and plugins, but that did not solve the current issue. Then I remembered I am using the the Newspaper Child-theme. I activated the main theme and deactivated the child theme. Now it seems to work both in backend and frontend.
I can not find anything strange in the childtheme, only some settings for RankMath SEO plugin that I know are there.
Still could use your professional advice dough regarding the database issue.
Sorry for the long read!
UPDATE: it seems I have solved the issue somehow, but I do not want to cheer ahead. For now it is working.
Solution (for possible other readers):
1. restarted my server
2. Accessed Plesk and started SSH
3. used command: sudo systemctl edit mariadb.service
4. located [Service]
5. typed below that: OOMScoreAdjust=-1000
6. Important that you type minus (-) 1000
7. Changed theme from Child theme to Newspaper main theme and that solved the wrong display
8. After an hour testing everything changed the theme back to Child the of Newspaper
9. Display stayed as intended
Hopefully this has resolved the issues I’ve encoutered. Can you leave this ticket open for a few weeks in case the issue reappears?
I don’t think it is a real Nespaper issue in hindsight.
I am however curious if anyone knows what that alexusMailer_v2.0.php etc can come from. As far as I good figure out it is a programm to send anonimous emails, probally missusing our domain.
Any other insights on all above issues are very welcome. Thanks for your time spend anyway!
Hello,
What can I say, your experience was quite an adventure! I’m glad that in the end, you managed to solve it. Also, if you haven’t already done so, I recommend using Wordfence to scan your website. You can also use a CDN for added security. Also, the topic will remain open in case another user has experienced the same issue and can offer you some advice.
Have a great day!