Malware/Adware on my wordpress blog--want to reinstall - php

My Wordpress site has some strange adware. Sometimes it redirects to www.usgrants.org , and at one point there was some random text at the bottom of each page that looked like search engine keywords, but that text seemed to have disappeared for now.
So instead, I've decided to back up my blog, and just start fresh with my database, and just reinstall the plugins that I really need.
The question is, how can I do this without losing my content?
I am guessing it is just as easy as exporting my SQL database, deleting everything, reinstalling WP, and then importing it, but I'm not sure if that's the most efficient way.
I'm also looking into Duplicator, but I don't know if that would also migrate the problematic add-ons (I don't even know what the cause of it is).
I'd really love to keep my Thesis theme as well, but I'm not sure if my custom code is causing the problem.
I appreciate the help!

First and foremost if you are still able to get into the admin area of your site, I would install WordFence (http://wordpress.org/plugins/wordfence/), do a complete scan of your site, and make the recommended fixes. Additionally, if you can spring for it, I would get the premium version as it will scan all files on the server, not just in the wordpress install. (I think it's like $40 per year per domain & gets cheaper the more you add.) This option may rescue your current site without the need to start fresh.
That said, if you have malware in your site, it's very difficult to know for sure that it's fixed for good. Depending upon how it's written, it can lie dormant for a while and come back when you least expect it so starting over may be the best idea. Regardless, I would use WordFence to scan first before you start fresh since it will also scan your database to see if anything ended up in one of your tables there. The free version will do that too.
Then you can either export and save your database from MYSQL or you can also use the wordpress export / import tool to manage the transfer of your content. Its a pretty simple process.
To export your site data using the included WP Export tool.
1. Login to the backend admin
2. Navigate to tools
3. Click on 'Export'
4. Select the All Content option and then press the 'Download Export File' button.
5. This will download an XML file that you can import on your new instance of WP.
To import your site data using the WP Import tool.
1. Login to the backend admin
2. Navigate to tools and click import
3. Select 'WordPress' from the list
4. Install the importer
5. Click Activate and Run Plugin
6. Choose the XML file you exported and then select Upload File and Import.
Hope this helps!

Related

WORDPRESS - Clone Website on a New Installation to Update It

We need to recreate our site from scratch. When I mean from scratch I mean we want to keep the same content (pages, articles, URLs and tons of media) and move it to a new WordPress installation with a different theme.
A brief background to try to understand what the underlying problem is. The current site (the one to be copied and transferred) is HUGE. It has more than 1500 pages and 3000 articles. It is currently running on an old version of WordPress and an outdated theme. We are deliberately not updating WordPress, theme and PHP so as not to risk crashing and being left without a site (this has already happened in the past with another installation).
What we have done is to create (on the same hosting) a new, updated installation of WordPress (on another directory). This will be the new and definitive one. Then – when all is said and done – we should use the name of the first installation (but this will be another issue to deal with at the end). We decided to operate in this way because we want everything to be done as safely as possible.
Some details:
Objective: SITE 1 -> SITE 2
SITE 1: Installation: domain.org/directory1 WordPress 5.2 PHP 7.1.33
Theme: Awaken
SITE 2: Installation: domain.org/directory2 WordPress 5.7.1 PHP
7.1.33 Theme: Divi Builder
At the moment, we have already installed the new theme in directory2 and created the home page that will host all the pages and articles from the old site. We are not interested in keeping the plugins. Our aim is for the new installation to be as “clean” as possible, without the risk of dragging around old problems.
What do you think is the correct way to proceed? Again, the most important thing is that the links are not changed (so that the URLs will still work once the change has been made; I mean: domain.org/directory1/perma/link/article-written-in-the past = domain.org/directory2/perma/link/article-written-in-the past
Could the export/import tool do this job? How should I proceed to make sure that I don’t affect the performance of the new site? Is it possible to carry out a test with a few pages to see if this can be done?
Thank you all!
The first step is to create a backup of the existing site. You can do this manually, you need all of the site files plus the database.
However, Duplicator is a great plugin that will create a backup package that includes everything for you. One thing to be aware of is the size of your site may cause issues for the plugin do to server load, but its the easiest method. There are other plugins as well to help with migration.
Once you have everything you can copy it to a new domaon like dev.website.com. The installer from Duplicator will help with the url updates, but its pretty easy to adjust in the config file and database options table. If you use relative urls most things wont be an issue, but a simple find and replace in the database will easy update any absolute urls.
Once you have made all your changes in dev you just reverse the process by writing over the live site and your set. This is safe beacuse you have a backup of the live site from step one in case you need to revert to the current state.

Proper way to update WordPress plugin (for updates)

I am making a woocommerce website and I was wondering what is the best way to update plugins (details) and still be able to update the plugin.
For example, I have two plugins that I just want to change the content in them like the currencies in woocommerce writes د.ب which is in Arabic Bahraini Dinar and I wanted it to be BHD.
Also another example I wanted to change in the wc-vendor plugin the namings instead of calling them vendors I want to call them artists.
I been reading articles about the best methods to update a plugin but I am not sure if they are also valid if I just wanted to change the "Naming" not "functionality"
https://www.seedprod.com/customizing-wordpress-plugins/
Summary:
I appreciate if you can tell me how to change plugin content and still be able to update it.
Thanks!
If you're using plugins developed by others, you may have more problem again in the future if the plugins update. Ask the developer or create an issue regarding the problem. Unless you're writing it of your own, you can play the changes locally or create an staging environment. If sound no problem, that's the time you need to replace code in plugins directory.
I assume, upstream developers are not able or willing to provide hooks for your need.
If you really must modify a plugin, put the plugin source code in a version control system (Git, Mercurial, ...). Make a branch for your changes, and each time a new upstream version comes up, import the upstream version and forward merge your modifications.

Trying to pinpoint code being added to wordpress site

I've just started doing some website work for a local business, and I noticed today that there's a very unwanted link at the bottom of their site, which is a wordpress site.
The site makes use of a woo theme called 'whiteLight', as well as woocommerce. I've tried disabling and reenabling all plugins that aren't well known and integral to the site's functioning, and I've sifted through a lot of the theme's files.
I can't find where this line is being added to the site. The line "<center>*bad link here*</center>" is being inserted right after the header and right before the closing body tag, on the home page only. The link in question is actually linking to naughty files inside a directory within the wordpress installation. It's not even taking users to an ouside site as far as I can tell.
I don't have FTP access to the wordpress directory yet, but I've requested it. I have very little experience with wordpress hooks etc, and am hoping someone can help me find a starting point in weeding out this unwanted link.
Thanks in advance!
WordFence is the best security plugin for WordPress. I'd recommend you follow the instructions at https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
Another good resource to read is https://codex.wordpress.org/FAQ_My_site_was_hacked
I recommend you search all the files as norlesh suggested. If this was my problem I'd use Jetbrains PHPStorm to search all the files. Another much cheaper solution would be to use Textpad - https://www.textpad.com/
It's also possible that the link has been inserted into your database. If so you won't find it in your files. You'll have to search the database. Use a program like phpMyAdmin or MySQL Workbench to export the whole database to your machine. Then search the sql file for the URL. Alternatively use https://interconnectit.com/products/search-and-replace-for-wordpress-databases/ which is a handy tool you upload to the server. From there you enter db login details and search the database. Note if you use this script you should delete if off your server when you've finished using it, it's a huge security risk.

I want to duplicate my WordPress website, but how do i deal with the database?

I wish to duplicate my current website so I can play around and try new ideas, before putting them on my live site. The reason I want to duplicate is so I have all of the content etc, so I can see how it really looks. I understand I can just copy my entire WordPress install into another directory, but what do I do with my database?
Currently my WordPress is installed into the root directory, I will simple create a new directory called Dev. Then simple just add /Dev to my URL and voila, I can view my duplicated website.
But how do I deal with my database? I am using a MySQL database, hosted with GoDaddy.
(I want to change my hosting from GoDaddy to someone else once the renewal is up, mainly because of their support for SOPA. anyway that's for another time...)
If you have phpMyAdmin installed, you may export your wordpress database, then create a new database and import the .sql file you just exported. Next, configure the copied wordpress to use your new database. The configuration is in wp-config.php. Good luck :)
Like the other answers here i suggest you export your DB via phpmyadmin if can. You will however notice that all image URLS point to the old domain. To fix this run a find and replace script. I usually use this one: http://interconnectit.com/products/search-and-replace-for-wordpress-databases/
Good luck!
The simple way with GoDaddy is to log into your account, go to your hosting management and click the databases tab at the top and then look for phpMyAdmin.
Once in phpMyAdmin, go to the wordpress database and select the operations tab at the top and then use the "Copy database to:" feature.
If your version of phpMyAdmin doesn't show the copy database feature, you can export all tables of the database and import them into your duplicate database.
Hope this helps!
If you don't want to mess around with a new utility like phpmyadmin, you can install a wordpress plugin to back up your database. Then you can copy your files anywhere and use the same plugin to restore the database. I personally use UpdraftPlus - Backup/Restore.
It should be noted that moving your site to a new folder or domain will break a lot of the database data. A simple search and replace is not enough to fix it.
For more information, you can go here: Wordpress Codex

Wordpress site release management strategy

I'm updating an existing wordpress site making significant modifications the the theme and site structure, as well as making updates to plugins which in turn store their data into mysql database.
As far as I'm aware there are 2 (3?) possible strategies here:
'Dump-and-load' MySQL database from DEV to LIVE and replace wp-content folder with latest updates.
Import changes via WP-importer and replace wp-content folder with latest updates.
Make database changes manually via WP admin interface and replace wp-content folder with latest updates (this is useful only for minor changes).
While I am developing in my own separate environment this is for an existing website which is currently live and will continue to receive updates from the public such as comments and entries into contact forms, hence I expect the database to be different now from when I release my changes.
Given this the options above provide the following problems.
1. DUMP AND LOAD
The 'dump-and-load' strategy seems to be out of the question as my data is being updated behind the scenes (this would have been my preferred approach as this is easily rolled back).
Result: requires synchronising databases post release to get latest updates, TOO COMPLICATED.
2. USE THE IMPORTER
Using the WP-Importer plugin page and post IDs will get updated, screwing up styling that relies on the post IDs to get activated. This in turn creates a CSS nightmare that I wish to avoid, having to go though the CSS after release to update the new page/post IDs with the ones the database created.
Result: Too finicky, not very professional approach leading to long and complex release process.
3. UPDATE DATABASE MANUALLY
This option is great for small changes but when for more complex releases the list of steps to follow on the PROD interface becomes long and hard to follow, making it easy to make mistakes.
Result: Too easy to screw up, only a last resort.
IS THERE A STANDARD WORDPRESS RELEASE STRATEGY FOR EXISTING WEBSITES?
So basically, my question is: What release process do other wordpress developers follow when UPDATING an existing website? Is there an option that I have not listed below that minimizes hassle and reduces time and complexity during release?
I've set up source control for the site using GIT and I am used to automating things via ANT or similar release script, this may be overkill for the current project but would be ideal to at least know of a simple way to update a wordpress site and minimize the chances of screwing it up.
Thanks!
I don't think this is particular to WordPress, it's a similar situation to any custom site. I personally favor replaying the SQL changes on production that were made on dev. The tricky part is that you have to know what SQL changes were made. For example a certain plugin may make some schema changes when you install it - you need to know what they were. You can do that by creating an export of your DB as SQL before installing a plugin, then take another export after and do a diff on the files.
Since you say you're making the modifications then I might assume you know what SQL changes you are going to make? Just make sure all changes you make to the DB are in the form of SQL script files and not just editing using the GUI (you can use the GUI to help write the queries, but save the actual SQL). After all of your changes are done you should have a bunch of SQL scripts that you ran during your development process - you can re-run them in order without encountering errors.
Then when it's time to push to production, create a staging version of production (that is take a fairly current DB backup of production). Run your update scripts on that and test that everything is ok. If it is, then you can run on production.
definitely make a backup of production before running any changes on it!
The guy behind WordFence was working on a deployment plugin called
Deploymint.
There's a new one called WP Stack.
Metal Toad Media discussed using Capistrano, but that Capistrano isn't specific to WP.
CrowdFavorite launched a service called
RAMP.
Needless to say, you have some other options. If you're making db changes manually make sure you're working with the serialized data effectively. I recommend using Search and Replace DB. WordPress also had a great little trick for changing the site url entirely from the wp-config file.
I assume you have everything running in a test environment. I would then:
Create a new database in your live environment.
Preload it with all content and configurations for the new site.
In your test environment, configure your config.php to point to the new database.
Upload all files to the live server. Upload your config.php last.
This will minimize downtime.

Categories