abletec

Hi, Wend. Let me answer your 2nd question 1st, & then we’ll explore the 1st 1 a bit. What you do is very much dependent on your hosting provider. Some, like me, have a spot in their control panel called addon domains” or similar, where you can add a domain to your existing account. I’ve had clients from Siteground, but I never looked into that particular aspect, so I’m uncertain as to whether they provide that or not. If not, then yes–you’ll need to get a 2nd hosting package.

As to your 2nd query, you can’t go wrong w/any of the core WordPress themes (they begin w/the word ‘twenty’). They will all make nice sites for you, & they’re all accessibility enabled.

Hello, FDigital01, & welcome. This does seem to be primarily a problem w/your page builder &other plugins on your site, so our ability to help is likely limited, since the problem basically involves 3rd-party software. Having said thus, I’ll make a few suggestions & perhaps something I say here may (or may not) help.

The first thing I do in situations like this is to open wp-config.php & change WP_DEBUG to ‘true’. Please note that this is a security risk, so please change it back to false when you’re done. Then try to edit, etc, & see if any errors show.

Another thing you might try is to look in your web root & any subfolders for files called either error.log or error_log. These may contain error messages that might prove helpful. Lastly, sometimes your hosting provider has an aplet in their control panel called Errors or Error Logs which may also contain helpful error messages. If you’d like to post any of these here in your next reply, please enclose them in , as:

 line 1
line 2
line 3

Please let us know what you find out, if anything, ok? I wish I could be of more assistance, but when the problem is outside of core, it can be difficult to troubleshoot.

Hello, shaencase, & welcome. Your “coming soon” page says to log into your dashboard, then click the link in the banner at the top of the screen to make your site go live.

The other thing is, you’ve got wp-supercache running, which is a caching plugin. This may delay your seeing your changes, so I’d suggest deactivating that plugin until you’ve made all the changes you want to make, else they might not show up as expected. You may also find it necessary at times to clear your browser cache to see changes once the plugin is reactivated.

Let us know if that helps, won’t you, please?

Hello, Mark, & welcome. I guess I rather feel that if you’re not going to use the sandbox site, it should in fact be deleted, as an unattended website just sitting there hanging out makes a wonderful target for hackers, & they *will* take advantage of it, take my word for that. Plus it will make your problem disappear. If a2 hosts it, they should be able to nuke it for you, though I would suggest a backup first, just in case you change your mind.

There is another solution. Simply changing the permalinks of the pages in question will resolve your problem. Just go to ‘Pages > All pages’ select your blog & contact pages (1 at a time), click the ‘edit permalink’ type in contact1 or blog1 or whatever, clikc ‘Ok’, then click ‘Update’. Lastly, go to ‘Settings > Reading’ & ensure your “posts page” is set correctly.

Please let us know whether or not this helped, or if you need additional instructions/clarification.

Hello, nancy651, & welcome. You’re running a caching plugin on your server. Please first try clearing your browser’s cache (if you’re not sure how to do this, then please tell us what browser you’re using so we can help). If that does not work, please clear your w3 total cache. Again, let us know if you’re uncertain how to proceed w/that.

It might help us also to know which posts you’re not seeing.

Hello, DBradleyRI & welcome.

Unfortunately, the hack has very likely not been fixed. The reason is that, in the vast majority of cases, the criminals leave behind backdoors, ie, methods by which they can continue to have control of your site, unless you actively kick them out completely. A rogue user is likely not the only mischief they wrought.

This post is long. Please read it & follow the instructions, checking each off as you go. If you feel it’s beyond you, then I strongly suggest you post a job on jobs.wordpress.net under the ‘General’ or ‘Performance’ category.

A resource you can go to is:
http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked

When dealing w/a site compromise, the objectives are twofold:
1) Fix the site; &
2) Fix backdoors that the hacker used to gain entrance into your site, so this hopefully will not happen again.

Most people place great emphasis on objective #1, but, in truth, the 2nd one is actually the most important, as, without it, your site will continue to be reinfected.

Here are the steps to take.

First, notify your host, as this might be a serverside hack as opposed to simply a site compromise. Also, if you’re on shared hosting, the hack has the potential to compromise the entire server. Additionally, you may wish to take the site offline, & your host can help you do this. They might not help you–then again, they might. You won’t know unless you notify them. If they say it’s not their responsibility, (& it really may not be), then please continue reading.

Second, scan any devices you will use to log onto your website for malware (malicious software like viruses, etc). It does no good to follow these steps if malware phones your credentials home to their command & control center. It’s actually better to do more than 1 scan, each using a different program, as no single malware scanner can detect everything.

Third, secure your network. Definitively use secure FTP (file transfer protocol) as opposed to regular FTP. The port used for secure FTP varies from host to host. Many use port 22, some 2222, while others use different ports altogether. Check their knowledge base or call their support. You can ask this question when you notify them of the compromise in the first step. You can use a client like Filezilla, which can do secure file transfers.

Never log onto your site using a public WiFi hotspot, such as those in hotels, cafes, etc. Make sure you’ve changed the default password, Ssid, (&, if applicable) the username on your router/modem. If you don’t use wireless, turn it off in your router’s options.

All these steps are required to ensure that no one can snoop your credentials, etc.

Now that the device you’ll use to fix your site, as well as your network, is secure, it’s time to direct your attention to actually fixing your site.

Next, please log into your website hosting provider’s control panel from a secure connection and change all passwords, including those to any databases you may have set up. This includes your control panel/FTP credentials & your WordPress database. Also, change your salt keys as per the instructions in wp-config.php to log out all users. Please make the passwords long, containing upper & lowercase letters, numbers, & punctuation.

Next, take a backup of your website’s files. Be certain to label it such that the label contains both the date you backed it up on, as well as the word “hacked”–we certainly don’t want you accidentally restoring this backup! This can be helpful, though, in terms of perhaps being able to determine how this occurred, though my feeling is that it likely did so because of an outdated site, weak passwords, or unmaintained 3rd-party plugins or themes on the site. Probably you should just back up your web root. Depending on your host, it might be called public_html, htdocs, www, or /. If you don’t wish to back up the entire root, then at least back up your uploads folder, as well as others that might contain content that can’t be replaced.

Please also back up your database as well. The article at
http://codex.ww.wp.xz.cn/Backing_Up_Your_Database
shows you how to do that, in case you need it. The section regarding phpMyadmin is likely the most relevant to your case. It’s going to be necessary to search that database file to see if any evidence of the hack exists there. That can be done by opening the file in a text editor. To start off with, consider searching for the words:

<script
<? php;
base64;
eval 

preg_replace
strrev

This is not an exhaustive list, nor is the presence of any of these words conclusive proof of a site compromise, though some are more suggestive than others.

You might also wish at this point to backup your WordPress content. To do that:
* Log into your WordPress dashboard.
* Go to ‘Tools > Export’.
* Choose to export all content.

While in your dashboard, go to ‘Users > All Users’ and delete any users there that you don’t recognize, especially administrators. A WordPress account should never contain the username ‘admin’. If yours does, make an administrative account that does not contain the word (don’t forget to use a very strong password), then delete the old admin username account.

Also be advised that sometimes supposed image files can contain code, so open all your image files, particularly in your uploads folders, to ensure they really are images & don’t contain code. Better yet, if you have the images on your machine, replace files in the uploads folders with them.

If you find nothing, either in your database or in your /uploads folders, then the next step is to delete, then completely reinstall WordPress, as well as any plugins or themes you were using. Simply reinstaling WordPress from the dashboard is not effective. I also advise creating an entirely new database w/a new user & password. You can then import your content into the newly reinstalled site.

Please also let someone knowledgeable look at your .htaccess file so they can make certain no backdoor code exists there.

In summary, here are the steps:
1) Back up your WordPress files, including core, themes, & plugins;
2) Back up your database using PhpMyadmin;
3) Look through the database to insure there is no evidence of the hack;
4) Search the uploads folders for image files that contain code;
5) Let someone knowledgeable look at your .htaccess file.
6) If you have doubts about your database, please have a professional take a look.

It would also be helpful to install a plugin like Sucuri or Wordfence to scan for the compromised files.

Yes, & notice the difference in url’s of the products, ie,
http://www.dragogear.com/product/ranger-laptop-backpack/
which is visible vs.
http://www.dragogear.com/products/side-packs/tactical-laptop-briefcase.html
which is not. That .html extention applies to all those products that are password-protected, it appears to me. So why do they have that extention, do you know?

& this is why I asked you what I did, because I was uncertain & feared both of us barking up the wrong tree.