roundmom

I’ve also been cleaning up a hack, so just flat-out replacing my index.php file is a great idea. Any tips where I can find a clean copy?

I am 100% sure the files I removed were injected. Google reported my site as hacked and these files were part of that report. Furthermore, they had abnormally high traffic (direct visits to these files).

I ran the sucuri site check, but cannot afford their firewall protection.

As I am working to clean up the hack (through the suggestions of links above), I found these files and removed them.

I just want a way to secure up folders that I know contained bad files so that I don’t have to come back and check them while looking for the backdoor and other injected files.

I even just tried reverting my .htaccess file to what it was before I manually reset it.

# Use PHP56
AddHandler application/x-httpd-php56 .php

which gives me the same results as above. Still lots of white screen of death. Not a lot of 405 pages…

This is the function I see around line 1210 of pluggable.php

function wp_redirect($location, $status = 302) {
	global $is_IIS;

	/**
	 * Filters the redirect location.
	 *
	 * @since 2.1.0
	 *
	 * @param string $location The path to redirect to.
	 * @param int    $status   Status code to use.
	 */
	$location = apply_filters( 'wp_redirect', $location, $status );

	/**
	 * Filters the redirect status code.
	 *
	 * @since 2.3.0
	 *
	 * @param int    $status   Status code to use.
	 * @param string $location The path to redirect to.
	 */
	$status = apply_filters( 'wp_redirect_status', $status, $location );

	if ( ! $location )
		return false;

	$location = wp_sanitize_redirect($location);

	if ( !$is_IIS && PHP_SAPI != 'cgi-fcgi' )
		status_header($status); // This causes problems on IIS and some FastCGI setups

	header("Location: $location", true, $status);     //THIS IS LINE 1210

	return true;
}
endif;

I tried deactivating all of the plug-ins and tried my two test cases (a: a portion of an existing slug and b: a not-used slug).

b: worked the same as before. It redirected me to the 404 page.
a: gave me a white page that said
Warning: Cannot modify header information - headers already sent by (output started at /home3/roundmom/public_html/index.php:2) in /home3/roundmom/public_html/wp-includes/pluggable.php on line 1210

Switched to Twenty Seventeen with all plugins.
a: white page of death
b: 404 page.

Twenty Seventeen with zero plugins.
b: worked the same as before. It redirected me to the 404 page.
a: gave me a white page that said
Warning: Cannot modify header information - headers already sent by (output started at /home3/roundmom/public_html/index.php:2) in /home3/roundmom/public_html/wp-includes/pluggable.php on line 1210

So it appears not to be theme dependent. I get the same errors and results regardless of theme, so I am reverting to my original theme (Salon) to keep my site consistent while troubleshooting.

I will look at what line 1210 says on that php file, but even when I find out, I’m not sure where to go with that.

I am familiar with php and WP theme files; I have a degree in Computer Science. I just don’t want to have to spend forever going through every file trying to figure out where the contradictions lie. I was hoping you might be able to say, “it’s in this file, roughly this place” or something.

I know that there are many reasons why the page might not load. I read the documentation that lists the possible reasons. There wasn’t any instructions on what to do if I encounter those problems.

The page does not load properly. I have a “page blocked” message at the top, and the Blocks below are all greyed out. I followed the link in the PAGE BLOCKED message to the troubleshooting document.

The troubleshooting document says “First thing to check is Javascript console.” So I opened the Javascript console and just did a basic search for “async.” It appears multiple times in the Javascript console.

I went back to the document to see what I should do next. It only says “Make sure your theme does not add async or defer tags to javascript files.” How can I do that? There are no steps for making sure my theme doesn’t do this.