UPDATE: Our Site is now available to you (Theme & All Plugins Deactivated). Simply confirm once your actions have been completed!
Thank You!
there is something odd going on at the server level.. many XMLHttpRequests are not being honored or blocked… sometimes they go through…
are you running any server security software? such as mod_security or Sucuri or other?
did you do any modifications to the .htaccess file? (is it used in nginx?)
do you run any wp specific nginx configurations? like in /etc/nginx/common
Wonder if we pull in @fidosysop-2 who runs cloudflare and has it working… not sure if he has nginx though…
probably clear to put plugins and themes back up… clearly no impact from them…
one thing that I would also like to try, but probably not an issue is to turn off admin script concatenation… that would be to add following to the wp config file:
define(‘CONCATENATE_SCRIPTS’, false);
and just see…
Just relayed your comments & questions to our Server Admin – will come back to you shortly.
Response from Roger (Server Admin):
1. Yes, there is exploit scanning and AV scanning. If an IP address tries to upload an exploit, the file is blocked and the IP is denied access to all services (including http).
2. Yes mod_security is running.
3. .htaccess is blocking known “bad” bots
4. The server is LAMP
Replacing plugins and theme now…
Update: Server Admin Response:
Adding:
define(‘CONCATENATE_SCRIPTS’, false);
to wp-config.php, and then testing; did not resolve the issue.
figured it was LAMP… which has a history of issues with WP… they even have a configuration page for it: https://codex.wordpress.org/Nginx
thanks for trying the script concat stuff… didnt think it would work, but worth ruling out…
is it possible to temp disable mod_security and see what happens?
have sent @fidosysop-2 a pm to see if he has thoughts since he works with same environment and has worked through issues (both wp and sp)…
Server Admin Response:
WordPress is built to work on LAMP. LAMP is “Linux, Apache, MySQL, PHP” and Nginx is something else. The codex (in provided URL) has nothing to do with a LAMP server.
Disabling mod_security is a no-go because the site is under constant attack. Example in the time you worked on the site, there were 27 exploit attempts (uploading PHP exploit) that were all blocked.
Again, this is not an Nginx environment, it’s LAMP. 😉
Recommend we “cease & desist” at this stage, given the number of challenges. We need to step back an evaluate options, including a return to BBPress & BuddyPress (our them was packaged with them). Although we thought SimplePress was much cleaner & more User Friendly, we can’t afford to invest more time in “making it work” nor risk Forum impact with ongoing issues.
Thank you all for dedicating weekend time to explore resolutions.
@mr-papa just had to leave for a short while but it will be short. He may still want to comment on the server. Nginx is definitely involved on your server somwehere along with cloudflare as we were looking at the http response codes. But he is more server savvy than I am.
Curiously this is not actually a big issue.
If you load, say, the Components admin menu from the WP menu the processes all work. The browser button works and the smileys (the only file showing on the list) also drags OK. On a secondary load it stops. This is simply because your site is not allowing the AJAX calls to function. In short, in some way, your server is disallowing the AJAX. That should be a simple thing to put right but it is a server side/configuration issue that is stopping it.
I suppose our challenge is simplicity. Our Site has been working flawlessly with all existing plugins for many months. We expected the SimplePress Plug-in to also work seamlessly and flawlessly “out-of-the box. And were we to mover forward with any changes in configurations/processes, we run the risk of causing issues with other plugins that are all fine at present. We simply don’t have the time/resources and can’t run the risk of more bumps in the road going forward.
OK to cease & desist at this stage, while allowing the opportunity to now revisit BBPress/BuddyPress and other alternatives.
Your combined effort has been much appreciated.
Mr Papa said
there is something odd going on at the server level.. many XMLHttpRequests are not being honored or blocked… sometimes they go through…are you running any server security software? such as mod_security or Sucuri or other?
did you do any modifications to the .htaccess file? (is it used in nginx?)
do you run any wp specific nginx configurations? like in /etc/nginx/common
Wonder if we pull in @fidosysop-2 who runs cloudflare and has it working… not sure if he has nginx though…
probably clear to put plugins and themes back up… clearly no impact from them…
one thing that I would also like to try, but probably not an issue is to turn off admin script concatenation… that would be to add following to the wp config file:
define(‘CONCATENATE_SCRIPTS’, false);
and just see…
Running under cloudflare can be challenging. Do you have a free or paid plan? My two sites are running a pro act. It gives better control over blocking / allowing requests, and has a nice firewall.
I suggest turning off mod security on your server. Let cloudflare provide the security.
RocketLoader is causing lots of your admin errors. Dragging forums into order, smiley reordering, and getting a white screen after making changes in the admin panel.
Also disable combined caching when using cf minimification.
Create a page rule that disables RocketLoader for the forum page. This is best for front-end operations. Best bet when working in simplepress admin is to disable RocketLoader or put your site in development mode. When you are done be sure to dump the cache in cloudflare.
Regards, Ed