5 Android/iPhone Apps for IT Admins

Posted on by Will Simon
Category: Tutorials | Tags: , , , , , , , , , , , , ,
Reading Time: 3 minutes

As administrators for our servers, we may find ourselves needing to do certain things while on the go. We may also not have a laptop or PC within reach. But one thing most of us have at all times is a cell phone. Whether we have an Android or an iPhone, most of us do possess a smartphone. One thing great about these smartphones is their constant connection to the Internet. Having that constant connection makes it simple to use various apps that assist with admin tasks through our smartphones. Here is a list of five applications available both on iPhone and Android. If you are interested in checking them out, click on your phone’s type next to the application name. You can also search for these applications by name in your smartphone’s app store. Continue reading “5 Android/iPhone Apps for IT Admins” →

Delete Posts and Comments from Action Scheduler

Posted on by Luke Cavanagh | Updated:
Category: Managed WooCommerce Hosting | Tags: , , ,
Reading Time: 2 minutes

The Action Scheduler is a background processing, queue job runner which is built into WooCommerce core. A number of plugins use the Action Scheduler, WooCommerce Subscriptions and WooCommerce Follow-Ups being two of the best known.

WP-CLI makes it easy to delete posts and comments which have been created by the Action Scheduler in WooCommerce. There may be cases where the Action Scheduler might create a large number of posts and comments on your live site, and you want to clear up the data from the site’s database.

 

Delete Comments from Action Scheduler

To delete comments created by the Action Scheduler, you can run this command:

wp comment list --field=comment_ID --'post_author'='ActionScheduler' --number=1000 | xargs wp comment delete --forceThe number can be increased if you have more comments that need to be deleted to 2000 or higher.

Delete Bulk Posts from Action Scheduler

To delete all of the scheduled-action posts, you can run this command:

wp post list --field=ID --post_type=scheduled-action --posts_per_page=1000 | xargs wp post delete --forceThe number can be increased if you have more posts that need to be deleted to say 2000 or higher.

Delete Scheduled Action Posts

To delete all of the scheduled-action posts with a post status of trash, you can run this command:

wp post list --field=ID --post_type=scheduled-action --posts_per_page=1000 --post_status=trash | xargs wp post delete --force

Delete Bulk Scheduled Actions

To delete all of the scheduled-action posts with a post status of cancel,  you can run this command:

wp post list --field=ID --post_type=scheduled-action --posts_per_page=1000 --post_status=cancel | xargs wp post delete --force

 

Using a mix of these commands, you will be able to delete posts and comments easily, using WP-CLI on your site. It will also keep your site database clean, allowing it to run more efficiently.  Take the work out of maintaining your WordPress site with our Managed WooCommerce product.  Our WooCommerce platform comes with free iThemes plugins curated especially for online stores.

8 WP-CLI Commands to Clean Up and Optimize your Site

Posted on by Luke Cavanagh
Category: Managed WordPress | Tags: , , , , ,
Reading Time: 2 minutes

Want to clean up your WordPress site without having to add multiple plugins? By using WP-CLI, you can run many useful commands to helpfully clean up your database and elements related to your site. In this post, many of the most common tasks are covered:

Continue reading “8 WP-CLI Commands to Clean Up and Optimize your Site” →

What are Common Commands to Update WordPress Using WP-CLI?

Posted on by Luke Cavanagh
Category: Managed WooCommerce Hosting, Managed WordPress | Tags: , , , , , ,
Reading Time: 2 minutes

WP-CLI is a very handy set of commands. You can run anything that you would run in wp-admin on a WordPress site but from the command line. Useful commands which WP-CLI employs to keep WordPress core updated plugins including the default themes which come with WordPress.

Continue reading “What are Common Commands to Update WordPress Using WP-CLI?” →

Troubleshooting: Too Many Redirects

Posted on by Mark Cunningham
Category: Common Fixes | Tags: , , , , , , ,
Reading Time: 7 minutes

The error “too many redirects” means that the website keeps being redirected between different addresses in a way that will never complete. Often this is the result of competing redirects, one trying to force HTTPS (SSL) and another redirecting back to HTTP (non-SSL), or between www and non-www forms of the URL.

Continue reading “Troubleshooting: Too Many Redirects” →

Reset Your WordPress Admin Password

Posted on by Echo Diaz | Updated:
Category: Common Fixes | Tags: , ,
Reading Time: 1 minute

Whether its a hacked site or a lost password, you may find that you are locked out of your WordPress Admin control panel. If you’ve forgotten your password or don’t have access to the email address that the “Lost your password?” link sends to, you still have one more option to access it. Through the database!  WordPress’ database stores all WordPress username, encrypted passwords, and the user’s email address and thus can be edited through a database client like phpMyAdmin. In this tutorial, we’ll be showing you how to edit the email address and change your user’s password.

Continue reading “Reset Your WordPress Admin Password” →

How To Change Website Name in WordPress

Posted on by Echo Diaz
Category: Common Fixes | Tags: , , , , ,
Reading Time: 2 minutes

You may have noticed, when transferring a website, that the URL is still stuck on the old site even though you have changed the virtual host file to reflect the new domain name. Or you may see the URL entirely greyed out in your WordPress portal. This mismatch can happen if you can’t change the URL within WordPress to reflect the new site name. In this tutorial, we will show you how to change the URL through the database.

Step 1: Enter the Database

If you don’t have your database credentials you can certainly grab them from your wp-config.php file, usually located in /var/www/html. Copy your username and password, you’ll need these to enter phpMyAdmin.

/** MySQL database username */
define('DB_USER', 'yourusername');
/** MySQL database password */
define('DB_PASSWORD', 'userpassword');

If you Ubuntu 14.XX and higher, you can visit https://yourhostname.com/phpmyadmin and enter your database username and password copied from your wp-config.php. CentOS users can usually go to their WHM panel and type in “phpMyAdmin” into the search bar for a shortcut into their database.  With specialty platforms like Managed WordPress or Cloud Sites check with your support team to locate your phpMyAdmin instance.

Step 2: Find the WP_Options Table

Once you’ve entered phpMyAdmin, click on your database name on the left, in this case, ours is named 929368_kittens.In WordPress' database the wp-options table has the siteurl and home row needed to change the URL.

Locate wp_options, afterwards you’ll see rows on the right hand side.  The home and site_url row is needed as we will be changing these values to the new website name.

Note:
Search home or siteurl in the Filter rows: in the search box to these entries if not readily visible.

Select Edit in the row of siteurl and home to edit the URL, including “http” or “https” (if you already have an SSL on the domain name). Once you’ve changed your URL, select GO to save your changes.

In a WordPress database change the URL by editing the siteurl and home row.

Step 3: Update DNS

Your WordPress instance is now set to your new URL!  If you haven’t done so already, you may need to set your A record to your new IP address or clear your browser’s cache to visit your new URL.

Changing the domain name within WordPress is simple enough but sometimes code within an nginx.conf or .htaccess file can also direct a site back to the old domain name. It should also be noted that sometimes a plugin, theme or database can be referenced or hardcoded to read an old domain name.  For either problem, the Velvet Blue’s plugin or WP-CLI’s search and replace command cater to the issue.  Our Managed WordPress platform performs name changes automatically from our control panel, as well as core updates.  Check out how our Managed WordPress product can streamline your work.

WordPress Exploit – AMP Plugin

Posted on by Echo Diaz
Category: Security Bulletins | Tags: , ,
Reading Time: 2 minutes

AMP for WP -Accelerated Mobile Pages allows your site to be faster for mobile visitors. Along with last week’s report, the AMP plugin has also been added to the list exploited. The AMP for WP plugin was reported on October 20, 2018, by its developers. Luckily, the newest version, 0.9.97.20, of this plugin has patched for their known security flaws. This exploit has the means of putting 100,000+ users at potential risk, so its best to check if you are utilizing this plugin. In this tutorial, we will be checking if you use this plugin. Along with updating, we will also show you how to check if your site for compromises.

In the vein of the WP GDPR plugin exploit, the AMP hack allows code vulnerability to make site-wide changes. Bots scan for sites using the AMP plugin and use an XSS security bug to create a new user that has admin-like privileges. The vulnerable versions’ (below 0.9.97.20) code didn’t cross check to see if registered users had the permissions to perform some actions. With administrative like privileges a hacker can hide their code within your WordPress files to use to take over your website. Additionally, they can upload files, update plugins, read files, and inject posts.

Identify If You Use AMP for WP

By logging into your WordPress backend you can easily see if you are subject to this exploit.

Step 1: Enter the WordPress backend by going to yourdomain.com/wp-login.php in your browser.
Step 2: Login with your WordPress username and password and navigate to Plugins and click on Installed Plugins on the left-hand side of your screen.
Step 3: Scroll down through any installed plugins to see if you have Accelerated Mobile Pages within your list, followed by its version. Any version below 0.9.97.20 is still vulnerable and you’ll have to perform a few actions to protect yourself.
The Plugins section in WordPress will allow you to see if you are utilizing AMP.

Upgrade AMP – Accelerated Mobile Pages

Note: It’s recommended to backup your website before pushing any updates.

Step 1: Follow the steps above in the section “Identify If You Use AMP for WP” to login and locate your Plugins menu.

Step 2: Locate Accelerated Mobile Pages. If you are running an outdated version you’ll see a message providing you a link to update. Click “update now” to automatically update to the latest version.

 

In the WordPress backend click the "update now" link to protect yourself from the AMP hack.

Have You Been Hacked?

A site hack is possible even without noticing any visual differences to your site. For a closer inspection below are some of the characteristics of the AMP exploit.

  • Characteristics of the AMP hack:
  • External Calls to sslapis.com
  • New creation of WordPress admin user “supportuuser”
  • Post injections
  • Registered user can manipulate code
  • Code vulnerability in ajax hooks
    • ampforwp_save_steps_data
    • wp_ajax_ampforwp_get_licence_activate_update
    • wp_ajax_ampforwp_deactivate_license
    • wp_ajax_ampforwp_save_installer
    • wp_ajax_amppb_export_layout_data
    • wp_ajax_amppb_save_layout_data
    • wp_ajax_ampforwp_get_image

If have identified your site is compromised from above characteristics, you’ll want to remedy it immediately since other sites on the same server can potentially be affected.

  • Liquid Web customer can purchase a Malware Clean Up package
  • Manually remove the code from the infected files
  • Restore from a backup dated before October 20, 2018 (keep in mind this will still have the old version and your site will still be in danger).

As time goes by, more plugins will give way to more vulnerabilities but there are some proactive steps to ensure your site’s security. For insight into ways of protecting your WordPress site look into our article on the subject, The Best Ways to Protect Your WordPress Site.

 

WordPress GDPR Plugin Exploit – All You Need To Know

Posted on by Echo Diaz | Updated:
Category: Featured Articles, Tutorials | Tags: , , ,
Reading Time: 2 minutes

As of November 9, 2018, the WP GDPR Compliance plugin has been exploited by hackers. This plugin aids e-commerce site owners in compliance with European privacy standards. Since the very nature of GDPR is to protect the personal data and privacy of EU citizens, it should be tended to as soon as possible to avoid a costly cleanup. WP GDPR Compliance is also known for working in conjunction with many forms including Contact Form 7, Gravity Forms, and WordPress Comments.

The main characteristic of this hack is the addition of new users, users with admin privileges. These administrative users have full access to your WordPress site. With Admin users a hacker can alter your site without your knowledge, including making rouge pages or selling your visitor’s information.

This article shows WP GDPR users how to:

 

If you are familiar with how to log in to your WordPress backend you can easily see if you are using this plugin.

Step 1: Enter the WordPress backend by going to yourdomain.com/wp-login.php in your browser.

Step 2: Login with your WordPress username and password and navigate to Plugins and click on Installed Plugins on the left-hand side of your screen.

Step 3: Scroll down through any installed plugins to see if WP GDPR Compliance is within your list.  On this screen, you’ll be able to see the version of the plugin to the right of the plugin name. Any version less than 1.4.3 is vulnerable and should be updated.

Indentify if you are vulnerable to WP GDPR by locating the plugins menu in WordPress.

Note:
Documented evidence shows an inactive GDPR plugin is not vulnerable to the exploit.

 

Although this is a severe exploit, it is easy to patch and protect yourself by performing a simple update.

Step 1: Follow the steps above in the section “How to Identify if you use the WP GDPR plugin” to login and locate your Plugins menu.

Step 2: Afterwards, find WP GDPR Compliance, if you are running an outdated version you’ll see a message letting you know you can update. Selecting the “update now” link will automatically upgrade to the newest version.

Update the WP GDPR plugin to avoid a hacked WordPress site.

 

There is a couple of routes for identifying this hack, listed below, but you can also use the Wordfence Security Scanner or our read our blog article on the subject of exploitation.

Indicators of Compromise include the following characteristics:

  • Creation of new users with Admin privileges
  • A database user in the wp-users table named t2trollherten and t3trollherten
  • URL’s inserted into the code have seen as pornmam.com
  • Installation of the 2MB Autocode plugin, executed by WP-Cron via WooCommerce’s woocommerce_plugin_background_installer
  • The wp_options table within your database has an entry starting with 2mb_autocode or default_role  is set to anything other than “subscriber”
  • Recent edits to the wp-super-cache/wp-cache.php file
  • Creation of a backdoor file, /wp-content/uploads/…/wp-upd.php
  • Incoming IPs from:
    • 109.234.39.250
    • 109.234.37.214
    • 195.123.213.91
    • 46.39.65.176

 

If you deduced your site is compromised from previously mentioned characteristics, then you’ll want to remedy it immediately since other sites on the same server can be affected.

  • Liquid Web customer can purchase a Malware Clean Up package
  • Manually remove the code from the infected files
  • Restore from a backup dated before November 8, 2018 (keep in mind this will still have the old version, and your site will still be in danger)