Better to manually optimize the main css and js files yourself (see my long winded optimization thread for links to the best tools for that, esp js) vs running plugin. That way the optimized files get cached, not a process running to optimize stuff at same time as caching it (conflict).

Food for thought anyway 🙂

Often the 502 happens due to too many processes running (kill script). You can try limiting queries, turn off stuff like XMLRPC, images in search box, related stories with images (more from author), ajax show more, infinite pages scripts, mega menus with posts; increase execution time for php, memory allocated to site, memory allocated to WP (e.g,. 256M vs default 40M in wp-config.php – ) etc.

You can try do disable XMLRPC as that is often used as an attack vector from people trying to do pingbacks or comments via injections.

Disable pingbacks from the WP admin panel; then disable XMLRPC using line added to functions.php

add_filter('xmlrpc_enabled', '__return_false');

Also consider adding other tools like disabling password reset function, use security plugins like “limit login attempts” to stop bots pummeling your logins.

Add the hack to theme to disable images in the search box, or disable search in the header, and use simple classic search in sidebar.

Checking the error logs for site also useful, check post pages with F12 console to see what is loading and from where.

But, pretty much as I stated, you’ll need to determine WHAT is causing all the queries to go crazy.

I think you can set the option for ‘unique articles’ from the bottom of the page when editing home page — from the actual page, not in the page builder …. I always forget where that is 🙂

There is no theme with such an archive feature as themes manage design and general look/dbase queries, not backup/archive of content or dbase, or deleting old images and content.

You might look at some options that have been around for many years to auto-expire posts, which is how most people do that for issues of system resources.

Also, you can conserve disk space by uploading your images via FTP, then loading in to the post by pasting in URL; then use a plugin to simply auto generate one ‘featured’ image and related thumbs from FIRST POST. That’s how we do it on various sites.

one example – https://wordpress.org/plugins/post-expirator/

Probably don’t make a ‘protected’ post ?

https://codex.wordpress.org/Using_Password_Protection

I think the image must actually be in the post meta for it to show up in RSS feeds, unless you add a custom function to add featured image to RSS feed (I don’t have that code handy, but you could google it). Theme doesn’t control RSS feeds in any way- that’s done entirely by WordPress. And of course you need to have your RSS feed setting in the WP admin panel set to show ‘full post’ vs ‘summary’ — summary will never show the image.

NOTE – if you have a web host running Plesk/ONYX there is now a nice WordPress toolkit for the system that helps secure known issues with WordPress … and I thought I’d share some of the info from that plugin for ONYX systems for those looking for more info on hardening their setup.
=================================
The wp-content folder. The wp-content directory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the wp-content directory. The security check verifies that the execution of PHP files in the wp-content directory is forbidden. Note that custom directives in the .htaccess or web.config files might override this security measure. Also note that some of your plugins might stop working after securing the wp-content folder.

The wp-includes folder. The wp-includes directory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the wp-includes directory. The security check verifies that the execution of PHP files in the wp-includes directory is forbidden. Note that custom directives in the .htaccess or web.config files might override this security measure. Also note that some of your plugins might stop working after securing the wp-includes folder.

The configuration file. The wp-config.php file contains credentials for database access and other sensitive information. After WordPress installation, the wp-config.php file can be executed. If, for some reason, processing of PHP files by the web server is turned off, hackers can access the content of the wp-config.php file. The security check verifies that unauthorized access to the wp-config.php file is blocked. Note that custom directives in the .htaccess or web.config files might override this security measure.

Directory browsing permissions. If directory browsing is turned on, hackers can obtain information about your site (what plugins you use and so on). By default, directory browsing is turned off in Plesk. The security check verifies that directory browsing on the WordPress installation is turned off.

Database prefix. WordPress database tables have the same names in all WordPress installations. When the standard wp_ database table name prefix is used, the whole WordPress database structure is not a secret and anyone can obtain any data from it. The security check changes the database table name prefix to something other than wp_. The maintenance mode is turned on, all plugins are deactivated, the prefix is changed in the configuration file, the prefix is changed in the database, the plugins are re-activated, the permalink structure is refreshed, and then the maintenance mode is turned off.

Security keys. WordPress uses security keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY) to encrypt information stored in the user’s cookies. A good security key should be long (60 characters or longer), random and complicated. This security check verifies that the security keys are set up and that they at least contain both alphabetic and numeric characters.

Permissions for files and directories. If permissions for files and directories do not comply with the security policy, these files can be used to hack your site. After WordPress installation, files and directories can have various permissions. The security check verifies that the permissions for the wp-config.php file are set to 600, for other files to 644, and for directories to 755.

Administrator’s username. When a WordPress copy is installed, by default there is a user with administrative privileges and the username admin. As a user’s username cannot be changed in WordPress, one only needs to guess the password to access the system as the administrator. The security check verifies that there is no user with the administrative privileges and the username admin.

Version information. There are known security vulnerabilities for each WordPress version. For this reason, displaying the version of your WordPress installation makes it an easier target for hackers. The version of an unprotected WordPress installation can be seen in the pages’ meta data and readme.html files. The security check verifies that all readme.html files are empty and that every theme has a functions.php file which contains the line: remove_action(\’wp_head\’, \’wp_generator\’);.

make sure you only upload the theme folder and not ‘all files’ folder….

theme goes in

yoursite/wp-content/themes/

https://codex.wordpress.org/WordPress_Feeds

http://www.wpbeginner.com/wp-tutorials/how-to-add-ssl-and-https-in-wordpress/

https://support.google.com/webmasters/answer/6073543?hl=en

Also note, that WP cannot ‘enlarge’ thumbs from original image size, so you would need a plugin to allow thumbs to be enlarged to sizes above what you upload. At least that’s what we used to need to do over here. ‘thumbnail upscale’ seems to help with that. Might not have anything to do with your issue, but noting it here for others who chime in later “I’m having same problem…” if applicable …. 🙂

• This reply was modified 8 years by simchris.

I think we did something on one site for that,
we made an index.php file that had a refresh header …

although I think we then instead did an htaccess file for the them folder,
and did 301 redirect for index.php to home page of site. Something like that.

Downside is you need to replace those each time theme is updated.

Or, just grimace when you do theme update and month later see that single entry in your search console. I usually just go “(sigh) … stupid Google…”

I mean, how stupid do you have to be in the data mining business to not auto-ignore /wp-content/themes/ for indexing ANYTHING? Duh.

If you have already been infected; be sure to check your
>> theme option - header ad field

Clear that and resave. If it comes back, then you need to clean your dbase also!

The theme is fast — but theme cannot manage your server settings, content you already have like giant unoptimized images, lack of gzip/deflate running, expiration headers, etc., which need to be done for ALL sites/themes.

Test one of your posts with GTMetrix.com to see actual help and recommendations if you’re new to WordPress.

As noted, see last section
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/

I implemented this couple years back, and I think this is noted in my long winded 2 year old optimization thread in the best of tutorials section.

Right now, you’d need to manually edit the style.css, and then unhook the two default google fonts from the big functions file.

Would be nice to have it, as I had suggested long ago — but now it’s been well documented for many folks that Google fonts via CDN don’t impact site too badly, esp in Chrome where they get cached when using the most popular fonts (meaning they don’t get reloaded on your site visit if already there, so no speed impact).

Not sure that helped.

Check my long winded thread, starting from newest to oldest, not oldest to newest post.

Note – the freezing happens on various sites to lesser degree I noticed the other night myself, even on my own website … only happened when I first turned it on — and I’m now thinking that maybe the iPad was doing some kind of background refresh like getting iCloud photos or something — but not sure on that.

On a simple page with 100/100 pagespeed score, two logos, one photo, and font awesome, I noticed the slight freeze going down page at a certain point. Odd. On my page all the above fold CSS loaded up front, and using native ipad fonts other than FA.

Not theme specific — I also noticed this issue on LA Times where the page just died, and went blank partway down.

Later on, both worked fine — so I suspect some background process on iPad, but I don’t have a fancy “activity monitor” installed, and have not turned on the developer mode on my new iPad (had that on for old one). Need to connect to my computer to activate that.

But it was temporary — then worked just fine. Very weird.

Just adding to the “bizarro world” topic … nothing to do with this theme specifically, as I notice the “twitchy” behavior on multiple sites the other night — all around the same time; but then no issues later on (and I have a smooth scroll jquery thing too, so yeah — super noticeable)…..

Might actually be an issue with jquery — hm.

I posted some help info on this awhile back, you might want to search for.

Basically, you will need to do search/replace in your mysql dbase to replace all instances of http://yoursite with https://yoursite in posts

You should change the logo and favicon links in your theme panel

You should consider adding explicit paths to https site in your wp-config.php file (see wordpress.org codex/docs on how to edit that — good thing to learn)

You should also see Google’s own docs on moving from http to https as you should make sure your host theme panel has a setup to auto-redirect all http requests to https automatically with 301 redirect (or you can do this with htaccess file; but all modern web servers like Plesk Onyx have this option built in on the domain management page).

Hope that helped!

Oh… just reread that. On ipad you may have to clear cache completely… i ran into this with custom fonts loaded locally on server… im on ipad right now ???

Ideally, site should be https php5.6 or 7, and if using nginx make sure you dont have apache directives in htaccess. Http/2 is server managed and shoukd have nothing to do with theme. Check server error log for what is going on..only way you can sort that out.

The plugins come with ionmag premium… weird! I only know as i recently activated the red ones which was clue ?

https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/

There should be no plugins for TagDiv blocks in your /plugins/ folder – would be good thing to double check. For example if you had ionmag installed first, then switched on Newspaper, it might be seeing those.

Dunno. very weird! (I don’t work here, but use both themes.)

Might not be best solution, but what we did on one website was actually upload supplemental images via FTP then only did featured image via the WP media manager.

In theory you could likely ‘hack’ the theme function with an ‘if featured image, then make thumbs’ element. Might be useful “suggestion” for future update, actually.