Showing posts with label WordPress. Show all posts

Fixing WordPress Website Infected by .ico Malware

 More cases of WordPress websites being infected by .ico Malware are showing up and it is a difficult job to get rid of it completely and make sure site safe again, but it's not impossible. 

I wrote an article on fixing this virus problem before and it is recommended you check it first, it explains how to get rid of the virus by manual process simply by finding the strange looking PHP files and the .ico files which are spread across different folders, it makes it very hard to find if you are not someone who deals with these sort of things on a regular basis.

Just recently multiple websites were again infected by this malware, which in all instances caused the website's to go down and returned error messages like "There has been critical error on your website."

What does the malware do?

The malware may have originated from a compromised plugins (it happens a lot often on WordPress platform) which have now infected your whole server with strange looking PHP files in different folders which includes the core WordPress files and also the plugin files, when it does that a faulty plugin file can lead to your site going down, in some cases your admin dashboard won't be accessible in some cases the main site, and sometimes both. 

What to do now?

It depends on your experience in cleaning up sites and detecting infected files. If you are not a tech savvy person it might be difficult, best option is to hire somebody to do it for you and get it fixed completely. I have a lot of experience in this and if you want my help you can email me at depy45631@gmail.com and we can take it forward. 

For the developers, read this article, the cleanup process involves finding the strange files, you will know when you see one and also files with .ico extensions. Along with that I would definitely recommend the plugin MalCure which can save you a lot of time by helping you find the infected files so that you can clean it up yourself completely. 


Getting Rid of WordPress Malware (.ico Backdoor Malware)

Recently major malware campaigns on WordPress were launched, infecting and exposing vulnerabilities in many popular plugins which effectively affected hundreds of thousands of WordPress sites.

In this post we talk about a malware that affects the site by injected malicious .ico files at random locations, as well as index.php files and code snippets in core WordPress files.




One of the sites that I manage was affected by this malware, first course of action was to look for the problem being faced by other people, this article came up which was one of the very few links online that discussed the issue we face:

https://www.getastra.com/e/malware/infections/favicon-ico-malware-backdoor-in-wordpress-drupal

As discussed this hack injects files with .ico extensions in different folders. These ico files contain malicious PHP code which does all of the malicious tasks it is supposed to do, one is to spread the malware and infect further files.  Primary function of this malware is to redirect incoming traffic to some shady websites.

Steps that were taken

But did not work.

I tried finding the root cause, where it came from, which plugin caused but it was not very clear. However, I decided to take some steps to clean it which was to look for .ico files on the server, because some core files like wp-config.php, index.ph, wp-settings.php had the code these @include.. PHP which referenced to the actual files I was able to search for its location by decoding the Unicode text.




Using FTP I found the files which were in a deep folder:



After removing it we believed the problem was solved, but 2 days later the same problem was back, this time the .ico file was added to a different random location and the code injected into different core files.

What Worked

So far it was frustrating, like many on the forums who discussed this issue who woke up daily in the morning and checked for such files and cleaned it we too were doing just that, the malware kept coming back. 

Updating / removing plugins did not worked either. 

What work was cleanup of the core WordPress files completely. These WordPress files are files that are supposed to be intact and does not change with our changes. Follow these stes:

  1. Make sure you have FTP access to your site, also take backup of your files (any customized theme, plugins etc.)

  2. Delete these folders completely:
    wp-admin
    wp-includes

  3. When you delete the folders, also remove core files in the root folder where files like wp-config.php, index.php etc. reside. Make sure to copy contents of wp-config.php file as it contains details of your server / database.
  4. Download WordPress files from here: https://wordpress.org/download/ - unzip it and place it somewhere on your system.
  5. Now one by one first upload the files using FTP that you deleted from the root folder, make sure to replace important content in wp-config.php file.
  6. Now, it is time for uploading the entire wp-admin and wp-includes folder back. Use your FTP software to upload all the files. 
If everything is done right you should be able to access your site.

At this point all we can do is wait and see if the malware returns. In our case this method fixed the problem which makes it apparent that somewhere inside the core WordPress files the malware was injected and went unnoticed by security plugins like Sucuri and WordFence.

If you still face the issue even after trying this let us know in the comments. 

Solving "Preload key requests" point on PageSpeed for WordPress sites

Getting a good score on Google PageSpeed is important if you want to rank higher and in the process provide a better experience to your users. However with the constantly updating system of PageSpeed you have to tackle new issues. One of the recent updates now focuses on preloading key requests on your site.


Update 3rd Jan 2020 : Modified the code to support extra attributes like crossorin and type that is required for some other types of content such as Fonts file. 

Browsers are smart and to make use of it there's something called pre-loading of requests, that is you tell the browser to already pre-load a set of resources ahead of time which you know will be used in the future.

This tutorial is focused towards WordPress sites but the technique is same for any site, it's just a few lines of HTML that goes on top of the <head> of your website.

I won't discuss what's preloading a request is in detail but if you would like to know more check this out: https://web.dev/uses-rel-preload/

Note: There is another point that sounds very similar, it is "preconnect", it is for pre-fetching DNS that we know will be required.  There will be another similar tutorial for that, so stay tuned.

It looks something like this in the PageSpeed report:



/*
* Preload the s**t out of Google
*/

function stramaxon_preload_requests_html() {
$preloadRequests = array(
array(
'as' => 'style',
'href' => '/wp-content/themes/example/style.css',
'type' => 'text/css'
),
array(
'as' => 'script',
'href' => '/wp-content/themes/example/main.js',
'type' => 'text/javascript'
),
array(
'as' => 'font',
'href' => '/wp-content/themes/example/font.woff2',
'type' => 'font/woff2',
'crossorigin' => 'crossorigin'
),

$linksHtml = '';

foreach ($preloadRequests as $val) {

$attrs = '';

foreach ($val as $key => $att ) {
$attrs .= $key . '="' . $att . '" ';
}

$linksHtml .= '<link '. $attrs .' rel="preload">';
}

echo $linksHtml;
}

add_action('wp_head', 'stramaxon_preload_requests_html', -100);

The above code will go into your theme's functions.php file. All you have to do here it add elements to the array  $preloadRequests and define the href and as value as required.

Are you looking to solve another Google PageSpeed x WordPress problem? Let us know in the comments, we will be happy to write a blog post for that as well.

Setting up InspectorControl with Color Selection in Gutenberg | Gutenberg Series

If you have recently gotten on the bandwagon and have been trying out your hands with the Gutenberg editor and its developer interface then you may have spent good amount of time on already learn about the editor and creating your own blocks.

This tutorial however is not about creating blocks, I assume you have already created a block and now are looking to add option for the user to control color of something in your block, for e.g the background or text color.

I will write an article on creating an editable Gutenberg block from scratch using the best practices.




I started off with a very simple block, it has a block of text, just that, I also added predefined styles using the `styles` option, but I wanted the user to have extra control on how the block should look and so I wanted to add color selection option and reflect what they chose on the block, both on the editor and the front-end. Due to lack of documentation and guides on Gutenberg it took me a while to figure out how to do it correctly, but here we are. So let's start.

A few things to note:

  • I am using ESNext, it's just easier to write JSX in it, however if you know JS well you might already know how to convert an ESNext code to good 'ol JavaScript.
  • Also, this site uses some ancient syntax highlighter so bear with me until I get a new one.

Get the dependencies first

From wp.editor we need these:

const {
    InspectorControls,
    PanelColorSettings,
    ColorPalette,
} = wp.editor;

The above is what we need for Inspector Control and color selection, you might have others on your list as well, so that's okay. 

Then from wp.components get these:

const {
PanelBody,
PanelRow,
} = wp.components;

It's not very crucial for the whole color setting thing but still a good practice to get these components in order to make the inspector control look cleaner.

InspectorControl can be anywhere

Since it is something that appears in the sidebar and not as part of the content of block it doesn't matter where we place it in the code, it can be anywhere inside of the main wrapper of the block. Do note it goes inside of `edit` function of your block though.



I personally prefer assigning the JSX to a constant / variable and then use it conveniently in the `edit` function. So here's the code for outputting a simple color selection in the Inspector Controls.


const myInspectorControls = (
<InspectorControls>
<PanelBody>
<PanelColorSettings
title={ __( 'Block Background Color' ) }
colorValue={ blockBackgroundColor }
initialOpen={ false }
colorSettings={ [ {
value: blockBackgroundColor,
onChange: onChangeBackgroundColor,
colors: backgroundColors,
label: __( 'Choose a background color' ),
} ] }
>
</PanelColorSettings>
</PanelBody>
</InspectorControls>
);


That's it. You are done. Have a good one!

No, I am not leaving you in the middle, if you want help with understanding the code and also seeing an example `save` and `edit` function then read on.

What's going on? The tag <InspectorControl> defines the, of course, inspector controls, <PanelBody> is just a container component to contain our various settings.

<PanelColorSettings> is the real deal. It's the editor component that is responsible for bringing up the color selector and as you can see it contains quite a lot attributes, so let's go through it as well.


  • title: The title is what shows up as the control's title. 
  • colorValue: This is important one, you assign to it the value, i.e the color it will have. `{ blockBackgroundColor }` is the attribute that's been set-up when registering the block (we will come back to it later, if you do not understand how it will work then keep on reading.)
  • initialOpen: boolean, whether the panel should be open by default. 
  • colorSetting: it is an array of objects with four keys namely value, onChange, colors, and label
        value: The same color value blockBackgroundColor
        onChange: callback when the color is changed
        colors: This takes an object of color names and hex values and shows it on the color settings before the color picker. So you can show a few preset of colors if you want.


Now there can be multiple colorSettings in the array.

Let's see how we can make use of the new Inspector control we just added. First step is to declare an attribute for the block that will hold the value of the selected color as a string, we will name it blockBackgroundColor

attributes: {
blockBackgroundColor: {
type: string,
default: '#000' // is optional
}
}


And then bring that in your edit function

edit ( props )  {
const { attributes: { blockBackgroundColor }, setAttributes } = props;
// other code..


Remember we set onChangeBackgroundColor to the onChange event? So let's create that as well.

function onChangeBackgroundColor( newBackground ) {
setAttributes( { blockBackgroundColor: newBackground } );
}

Cool. Now we have a working inspector control that you can use to choose a color. However, it's of no use if you are not applying the selected color somewhere. Let's take a look at a simple example on using the selected color in both the edit and save function.


edit( props ) {

// all the other codes...


const myInspectorControls = ( <InspectorControls>...</InspectorControls> );


return(
<div
className="my-simple-block"
style={
{
backgroundColor: blockBackgroundColor
}
}>
{ myInspectorControls }
<RichText/>
</div>
);

}

save( props ) {

return(
<div className="my-simple-block"
style={
{
backgroundColor: props.attributes.blockBackgroundColor
}
}>
// something
</div>
);
}


Here's a screenshot of working example of a simple block with color setting




I have just uploaded a very simple Gutenberg block's plugin code that registers a block with color settings, you can find it here StramaXon Gutenberg Blocks

Stay tuned for more Gutenberg blocks tutorial, also let me know tutorial around which aspect of Gutenberg Blocks you want to see next, on my to-do list I have Alignment toolbar setting so do subscribe to get notified when it comes out.



Changes to Files not Immediately Applied on WordPress Blog

A few days ago I got a project to setup a WordPress blog on the client's website. Most of my work included editing and adding codes to re-design the look of the blog, so editing, saving and viewing is a normal process. But I found a issue of changes not updating on site immediately after I updated the files.

I have worked on WordPress many times, but this project required me to work in a different environment, by different environment I mean editing theme and other PHP files only through the WordPress interface and the Web Host was Yahoo which still provides a quite older version of WordPress for their customers.

As the primary job was designing the blog I had to edit and reload the blog page to see the changes on the live blog. Many times the changes didn't appear immediately on the blog, especially the header.php and other page template files.

While I was working on it, I didn't had much problem because of this issue but when the client tried checking the changes I made they complained about the blog not updating. I thought it was a problem with the web host but the actually cause of the problem turned out to be something else.

WP-Cache is what causing the problem

I didn't even think about it. I knew there were cache plugins for WordPress but my mind never focused on it. After exchanging messages with the client he sent me a link to a forum where the cause of the problem was mentioned and it was WP-Cache plugin.

Fixing it is easier than you may expect, just login to your WordPress Dashboard -> Settings -> WP-Cache

wp-cache plugin wordpress settings

When you are in the settings page for WP-Cache plugin, click the "Disable it" button to disable the plugin.

Once you disable the plugin, any changes you make to your WordPress files will be immediately applied to the live site. That's a good idea when you are working on a re-design and you need to preview your changes again and again.

If it's not WP-cache..

If you don't have WP-cache plugin for your site then something else or other cache plugin is causing the problem. Look for other cache plugin for your WordPress blog, you will find all your plugins in the Plugins tab. If you find one then just disable it to solve the problem.

If it's not even a plugin then you might need more help with your blog's technical details, so it's a good idea to try WordPress Support Forum.

6 Reasons to stay on Blogger

Since the launch of WordPress and Blogger, there's war not between the two CMS but between it's users. Those who use Blogger takes the blogger's side and those who use WP stays at it's side. These two CMS have there own pros and cons and you can use any one, this post is just for a reference.
If you are in a forum or group with bloggers using different CMS, you will see them arguing over which is the better blogging platform. I am on Blogger and many blogger in my contact suggest me to join WordPress for many reasons and i won't have any problem switching to it but there are reasons why i don't switch to WordPress now.
six reasons to use blogger and not wordpress fight war competition of CMS
If you had ever read an article for starting your blog with WordPress then you will want to join WordPress but there are several reasons you shouldn't join WordPress now and I am listing it below.

Six reasons to start blogging with Blogger

Note : These are my own personal opinion and i am not trying to force you to stay with Blogger.

1. Starting a blog with Blogger is easy

If you are starting a new blog then the most important thing you should always focus on is your writing and if you start blogging with Blogger then you don't have to worry about the anything else than your content.
But if you choose WP to begin a blogging career then you will put yourself into complicated process of setting up your blog and putting it online. Guys like me with web developing skills will find it easy and can setup WordPress blog but if you don't know about hosting files and databases on hosting servers then you can just mess your blog up.

2. Blogger is fully customizable

Blogger is more easy to customize with their template designer and custom CSS. You also have the access to your blog's template and you can edit the HTML source to put more features that any website can have, blogger is just like a normal site. There's not much difference in a Blogger site and a normal site then i don't understand why people using WordPress explains that blogger is not customizable? If you have the right idea then you can make any customization just like an WP blog.
WP is also customizable but if you are using the free version then you can't even add your own CSS whereas Blogger is free with all customization options.

3. Hosting? It's free and on Google

When you will use blogger you won't need to worry about the hosting, your blog's databases are secured on Google's CDN, what can be better than a Google hosted website/blog ? Again, it's all for free and the bandwidth is also unlimited.
Because a blogger blog's databases are hosted on people assumes that the blog is hosted by Google and it can delete your blog anytime ! But people with hosting service are completely safe ? No, your files can also be deleted anytime without any notice from your hosting server.
The owner of the main contents on your blog is you, thus you can download the backup files anytime and if you have a custom domain then you can easily transfer your backup on a new blog without even losing traffic and that's the beauty.

4. Coding knowledge is not necessary 

Let's say you want to start a blog to write about your pet store and you decided to start with WordPress, what you see is complicated procedure, first you have to start a blog, then signup for a hosting service then download and upload  WordPress on your server and then you can start blogging somewhere, this is not just time wasting but also you have to spend lots of money. You will get themes for your blog at rates starting from $40. At every point you will have to face difficulties and even there is a one line mistake on any of your database file on your server your whole website will stop working and you again have to redo it. And it seems impossible if you don't have good knowledge of coding, usually people start blog for their personal use and learning codes for setting up a blog is useless.
On Blogger, just sign up with a Google account, name your blog, choose a web address and a theme and get started. What can be easy as that ? You get everything for free from hosting to templates and you don't even need coding knowledge to design your weblog, just open the template designer in Blogger and give it the look you want..

5. Blogger is not good for SEO?

The sentence i hate the most from anybody, most of those who says this are generally from WordPress and some from Blogger (frustrated bloggers). People believe that WordPress is good for SEO and Blogger is not.Blogger is a Google product and you think Blogger is not good for SEO? Now i don't say that Blogger blogs get a plus point for SEO as for being from Google product but they would neither give Blogger a minus point in terms of SEO.
And why would Google start giving more importance to blog sorting by the CMS used ? Always remember CMS is just 'Content Management System' but the real contents comes from you, so whichever platform you are using don't worry about SEO as it depends on the content you create.      

6. Blogger is for Blogging

Blogger is actually for blogging. WordPress is used for multiple purposes, such as creating e-commerce site etc and that's why the procedure to set up a WP site is difficult because they are optimized for being blog and also a website.
For the blogging i will always choose Blogger, but for my Web Designing projects, Blogger won't work so well. But Blogger is a complete tool for writing and publishing it.  

+1 reason - Blogger blogs are spam free

Do you know why do you hear so many cases of blogger blog's getting deleted or removed ? That's because Google want to keep the Blogosphere clean and just to maintain that a blog that seems to be spam is reviewed and if it is found to be spam and violating the TOS it gets removed.
As far as i know WP don't delete blogs even if it is a spam but wait do you think they can make their way in ? To get a good popularity and most important good traffic they need better rankings on Google and if the blog is found to be spam then it will be removed instantly from Google search results and can be permanently banned.

I don't oppose WordPress

After reading the above stuffs you will call me a WordPress hater but i don't hate WordPress, it's also a great tool and that's why people use it and even i use it for my web designing projects but there are some myths about Blogger in people's mind and this post was written just to tell them that Blogger is not worth using and should be left just for WordPress.

What do you think ?

There are pros and cons of both the CMS i talk about in this blog post and shared my thought as a web designer. Tell us your own opinions for Blogger for Wordpress and also share your thought and experience with any of those CMS, we would like to here from you.