I have a WordPress website used to booking appointments and this was created by a company. I hired a while back.
Now I want to redesign the website, but I’m a complete beginner.
I want to test my ideas without affecting the live website. Should I use staging or duplicate
Elementor draft? ChatGPT says duplicating has more risks, but it seems like I have to pay for staging.
Need the pages to be real pages with the translated url too
The Avada 7.16.x theme crashes WordPress when define('FS_METHOD', 'ftpext'); is in wp-config.php and PHP is version 8 and higher.
This error has been an issue with Avada on our sites since PHP 8 came out.
I'd been putting off updating our PHP version because of this, hoping it would be fixed. I've brought it to the devs' attention in the past, too, but they were no help. Due to PHP2Shell, we had to upgrade our servers from PHP 7.4.xx to 8.4.xx and remove the FS_METHOD line, making updates much more time-consuming to implement.
Search results for this issue always say to set FS_METHOD to direct but I can't do that due to security concerns and write permissions that I can't change. I've tried setting it to ssh2 with a plugin that is supposed to enable that but couldn't get it to work (even though I can connect via SSH2 with PuTTY).
Some of my sites are running different themes (Newspaper and Kale) and they have no problems with FS_METHOD set to ftpext, so I don't think this is a server/permissions issue. I've also tried disabling all plugins on my Avada dev site, but it still crashes.
Error logging returns this:
LoginFatal error: Uncaught TypeError: ftp_nlist(): Argument #1 ($ftp) must be of type FTP\Connection, null given in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php:492 Stack trace: #0 [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php(492): ftp_nlist() #1 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(465): WP_Filesystem_FTPext->exists() #2 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(307): Avada_Server_Rules->is_htaccess_writable() #3 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(116): Avada_Server_Rules->maybe_upgrade_rules() #4 [ROOT_DIR]/wp-includes/class-wp-hook.php(353): Avada_Server_Rules::init() #5 [ROOT_DIR]/wp-includes/class-wp-hook.php(377): WP_Hook->apply_filters() #6 [ROOT_DIR]/wp-includes/plugin.php(523): WP_Hook->do_action() #7 [ROOT_DIR]/wp-admin/admin.php(180): do_action() #8 {main} thrown in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php on line 492 My best guess is this has something to do with class-avada-server-rules.php not playing nice with PHP 8 and/or WordPress, but this is moving into unknown territory for me.
Does anyone have any ideas or suggestions for things I can try to get around this issue? Maybe some edit to class-avada-server-rules.php that I can put in my child theme?
- - semi-related rant incoming - -
In the past I'd go to ThemeFusion (Avada devs) for support, but they only include one year of support per license. The only ways to extend support are to buy another license for $70 or a 6-month renewal for $50, which is ridiculous. No wonder Avada is a best-seller; if you don't buy another copy every year, you don't get support! Inflating their sales numbers that way is dishonest and should be illegal.
Anyway... I'm at my wit's end. Thanks for reading.
My performance with the pagespeedinsights scan is a 55 score
I want to start building websites for businesses and individuals. In the past, I only worked with Elementor; is there a better page builder available nowadays that offers good value for money? (The currency where I live has an exchange rate of 5 to 1 against the US dollar.)
Hello WordPressers :)
I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.
Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.
It generated the following files and directories:
Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.
The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.
The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.
The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.
Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.
At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.
A few interesting things about this virus:
![[link]](https://i.redd.it/kaq7j460vnyh1.jpeg){kind=link}
token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.function_exists() to test for various functions, so it can understand what it can do to its host server.wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.The following strings can used to grep/search for the infection:
Let me know if you need more details!
EDIT with information about the plugin*
The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.
It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.
The main code does:
Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.
On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.
It does various other things that I can't be bothered to write about :)
The site is super slow but I can't figure out why. I do have query monitor installed and its giving some of the above info but I have no idea what to do with it. Does anybody know?
Curious what agencies and developers are recommending to clients about downloading their own periodic backups. Hosting mainly on WPEngine and assume that backups are safe there, but with increased threat level from AI bad actors wondering more and more if we should force clients to periodically download complete backups in case something really goes sideways. Thoughts?
Hi! I’m the author of WP-dTree, and I’ve just released Content Trees: a fresh take on collapsible navigation for WordPress archives, pages, categories and tags.
It works with blocks, classic widgets and shortcodes. Visitors can explore branches without leaving the page, with post titles loaded as needed. If you already use WP-dTree, you can can try this alongside it - your existing widgets and settings stay intact.
It’s free and open source: https://wordpress.org/plugins/content-trees/
I’d love feedback, especially from people with years of posts or a deep page hierarchy. Is it straightforward to set up, and does it fit comfortably into your theme?
So Liquidweb who have bought out LearnDash and seem to be pushing everyone into their software packages most of which I don't need. We currently pay $199 a year and they're forcing us onto a $350 a year package that includes Events Calendar, Kadence and Give. I'm looking at alternatives and both TutorLMS and Masteriyo look good but I'm undecided about which one to try.
We have a site with 25 courses currently and use Groups to auto enrol users into these, some courses are in multiple groups. Each course has a certificate that uses get at the end. I've currently got BBForums linked to each Group although so that users can ask questions and open discussions. I might look at more polished alternatives to BBForums in the future. Lessons mostly consist of text, video presentations hosted on Vimeo, sometimes resource downloads and a quiz, once all lessons in the course have been completed there is an end of course quiz. So I think fairly standard.
Enrolment is through group codes at the moment although we are looking at building more courses and offering paid subscriptions in the future.
Thanks for any advice or experience you can give as I'm going to have to make a decision fairly quickly to make a move before December.
I created a page, designed and published it. It's live now. But when I go to the pages I can see the pages with no content but can't see the live page which I published a few days back.
I have a bunch of Woocommerce URLs being found in Google and they are definitely not in the sitemap.xml.
They are like:
I feel like I've ogne through every option in TSF. Any key settings I need to look at here?
I've blocked it in Search Console but wondering if there more of a solution that is at the root.
![[link]](https://i.redd.it/n49on3gk7lyh1.png){kind=link}
![[link]](https://i.redd.it/u76qo12s5myh1.png){kind=link}