Forum Replies Created

Viewing 15 replies - 226 through 240 (of 264 total)
  • Thread Starter dev

    (@devksec)

    Indeed its a strange issue.

    The exact error in the google merchant store is “Invalid image encoding [image link]” this is due to it being the page URL rather than an image.

    This is the support page:
    https://support.google.com/merchants/answer/6183365?hl=en

    Thread Starter dev

    (@devksec)

    Hello,

    An example product would be:
    https://cyborg.ksecsolutions.com/product/sparrows-spool-pins-cut-away-lock/

    You can check the schema within the page or use the google structured data tool.

    Thread Starter dev

    (@devksec)

    Ithemes security (hide login) had to be disabled before we could gain access to WP backend and restore of the .htaccess file

    Not sure what caused the .htaccess file to break in the process but something removed the default wordpress lines.

    • This reply was modified 5 years, 3 months ago by dev.
    Thread Starter dev

    (@devksec)

    So we’ve given it another go and the results were as follows:

    1.Disabled DB caching & enabled object caching.
    2. 2000+ objects with about 150Mb new usage on memcache. Cleared all caches
    3. 404 error pages on products, pages & blogs but not home page (Affects all subsites)
    4. Reset permalinks on one subsite but backend started to time out.
    5. Noticed some pages being accessible but then front & back end started to timeout on all sites. (steps 1-5 were over a 30/40 min period.)
    6. Restarted apache + phpfpm
    7. 404s on pages,products etc again on all subsites
    8. slow loading & timeouts on front-backend again
    9. left for 10~mins and total of 2500~ items in memcache with 200mbs mem used. Site still unusable and 404 pages on front end apart from homepage
    10. disabled object caching via master.php & restart apache + php-fpm
    11. 404 errors now on wordpress backend custom login pages & front end
    12. full cache clear
    13. reboot of services again as 404 issues not resolve
    14. reboot of memcache server

    Trying to now recover the site but no better to finding out what is causing it.

    Thread Starter dev

    (@devksec)

    No worries, thank you for your support.

    So when enabling object crashing eventually the whole multisite goes down not just the wordpress backend. This is where we start to see the issue before eventually the whole site does. A reboot of the server nor services brings it back and requires for it to be disabled within the master.php.

    We’ve been using memcached tools to check the contents. This is how we know with the previous RDS config pagecache had some data chunks in there and could confirm DB caching works correctly now with the RDS changes.

    Thread Starter dev

    (@devksec)

    Definitely misleading that pagecache would input some data into Memcache without the RDS config changes but DB cache wouldn’t. I suspect both weren’t working despite this being the case.

    Is there a way for W3TC to detect improper setup of Memcache ? E.G error if it detects cached data isn’t being read/written to Memache correctly.

    DB caching & page caching seem to be working ok with Memache now just when switching to object caching we have this issue.

    The Memcache server has lots of memory free so thats not a problem.

    Thread Starter dev

    (@devksec)

    Update: we created the custom options group in AWS for the RDS instance and DB caching started to work properly with Memcache. Seems Pagecache worked without this from reviewing the Memcache data.

    Objectcache when enabled (DB caching disabled), starting to create 1-2k objects in Memcache before the website eventually went down again. Could be resource issues when objectcache is enabled and start a heavy load on the server but seems odd.

    Thread Starter dev

    (@devksec)

    The prod and dev environment are exact copies of the multisites. For this test, the other difference was instead of RDS we used a local MySQL. Apart from that the load on the server from external users.

    Is there anything we can do with W3TC to diagnose this ?

    Thread Starter dev

    (@devksec)

    So we’ve copied the prod version of our multisite to a new dev site with no outbound internet access apart from cloudflare etc. It can be configured to use either object Memcached or disk cache without issue. It seems we cannot replicate the original issue within the Dev environment.

    No errors in wp-log and nothing out of the ordinary with the W3TC debug on the dev site.

    Tried again in the prod site and object caching seems fine with disk caching but with high PHP CPU usage (up to 70% instead of 1-15%). This slows the site down in general. When switched to Memcache it starts to slow the site before getting constant timeouts. Restart of the wordpress services and it starts up and will only serve timeouts within the access logs. Only way to stop it is to disabled object caching within the master.php and restart the wp services again.

    Have tried using ‘wp cache flush’ and clearing the Memcache directly but still wont work with Object cache + Memcache enabled.

    Thread Starter dev

    (@devksec)

    Yes it worked for 4-6 months without issue before causing performance issues and we switched to DB disk caching. When re-enabling it with object Memcaching, it breaks the wordpress management interface.

    With the pro purge log, can the cache be purged without access to the WP management interface? E.G can it be triggered via the wp command line.

    I’ll get the WP debug setup on our test environment and see if this shows any useful info and report back.

    Thread Starter dev

    (@devksec)

    We’ve also moved the WP instance to a new host and cleared the cache folder within WP but the issue persists.

    Thread Starter dev

    (@devksec)

    No worries, we appreciate your support.

    So before we setup a Memcached server, we had issues with PHP performance on the EC2 instance caused by object caching leading to hanging and timeouts. This lead to the same behaviour as we had now and disk DB caching was used instead.

    As the wordpress backend crashed pretty quickly once object caching is enabled, is there a way to view the W3TC logs with debug mode enable if wordpress is inaccessible ?

    Thread Starter dev

    (@devksec)

    Hello,

    So I’ve taken this from the master.php as the I can’t upload a screenshot but can email one over if preferable.

    "objectcache.configuration_overloaded": false,
        "objectcache.enabled": false,
        "objectcache.debug": false,
        "objectcache.debug_purge": false,
        "objectcache.enabled_for_wp_admin": false,
        "objectcache.fallback_transients": true,
        "objectcache.engine": "memcached",
        "objectcache.file.gc": 3600,
        "objectcache.file.locking": false,
        "objectcache.memcached.servers": [
            "SERVER.cache.amazonaws.com:11211"
        ],
        "objectcache.memcached.persistent": true,
        "objectcache.memcached.aws_autodiscovery": false,
        "objectcache.memcached.username": "",
        "objectcache.memcached.password": "",
        "objectcache.memcached.binary_protocol": true,
    <snipped>>
    objectcache.groups.global": [
            "users",
            "userlogins",
            "usermeta",
            "user_meta",
            "site-transient",
            "site-options",
            "site-lookup",
            "blog-lookup",
            "blog-details",
            "rss",
            "global-posts"
        ],
        "objectcache.groups.nonpersistent": [
            "comment",
            "counts",
            "plugins"
        ],
        "objectcache.lifetime": 180,
        "objectcache.purge.all": false,

    We have a single Memcached for DB caching, page caching etc which is very underutilised. When we disable DB caching, we clear the cache before enabling the Objecting caching.

    Thank you for the assistance

    Kind Regards

    So for anyone affected by this I would do the following:

    1. Ensure you have a WAF in place such as Wordfence or similar
    2. Remove the vulnerable pluging that the attacker is trying to exploit “TI WooCommerce Wishlist’ – This needs to be deleted not just disabled
    3. Delete the attackers user account
    4. Block the IP of the attacker in your WAF (Be aware they will try again from different IPs)
    5. Setup looking with WP-Logger so you have audit any of the sites activities
    6. Setup a captcha as a measure to stop automated orders

    You can also block a lot of malicious traffic by updating your .HTAccess files to stop bots/and scripting tools from making requests to the web server.

    Thread Starter dev

    (@devksec)

    Can anyone confirm v3.0.2 fixes these issues ?

Viewing 15 replies - 226 through 240 (of 264 total)