2

I don't really know how to express my problem, so bear with me. This is a bit hard to explain.

I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-admin/install.php file. Asking for my login credentials of course. I have tried reinstalling WordPress and still have not been able to figure what they are doing.

That happens regularly. Also, a few hours later, I am able to see my site normally. Hope this makes sense.

I suspect there myst be some database DoS that allows them to inject a redirect of some sort into my admin area, thus redirecting the user to said directory (install.php). But that's just me. I really have no clue what else could they be doing.

I looked at the source code from several php files and noted some of them don't include a ?> tag. Could that be an issue?

My hosting company is iPage, I've contacted them and they say there's nothing wrong with my files. Anyone have a clue? I can paste the code to any source file.

Improve this question
10
  • Did you attempt to upgrade WordPress or plugins prior to noticing this behavior?
    – JCL1178
    Mar 26, 2014 at 1:38
  • This behavior has been around for months. Since it's a new domain, I didn't noticed that was happening until weeks later. At this point I don't know if that happened prior to any Wordpress updates. But I believe so, because I only noticed it weeks later, the site would go "down" for a couple hours and then came back by itself. I just wasn't aware.
    – saul
    Mar 26, 2014 at 3:22
  • Have you seen this question? There are some answers there that sound like they would be worth checking. (And if they do solve your problem, feel free to come back here and answer your own question with the solution – it might be helpful to others in the future.)
    – Nick
    Mar 26, 2014 at 9:24
  • Does the redirect occur only when going to the admin login page, or when accessing any page in the public part of the site as well?
    – nathangiesbrecht
    Mar 26, 2014 at 15:52
  • It's really hard to say what's going on. I basically uploaded a blank htaccess file to my Admin folder and installed Wordfence Security plugin. Although the site has been running "without" problems for the past few days. One day, while I was logged into the dashboard, the site again redirected me to the install.php. It used to happen several times a day, so I'm sure either the htaccess file of the plugin have had some effect. We'll see how it behaves the next few days.
    – saul
    Mar 31, 2014 at 3:00

7 Answers 7

Reset to default
3

So, I have had the exact same issue with a WP installation on iPage.

After a lengthy discussion with support about the issue, I found out that after the query limit of your hosting plan is reached (for whatever reason that may be... such as bugs on your site...), iPage automatically re-directs to www.yourdomain.com/wp-admin/install.php.

Now, it does this not only from the browser that has your passwords and cookies for your WP installation stored, but ANYONE then has access to www.yourdomain.com/wp-admin/install.php. This means that as soon as your query limit per hour is reached and until the hour resets, literally anyone has the opportunity to install a new instance of WordPress on your domain and fill it with whatever content they choose. In such a case you would only be able to physically delete the new install through iPage's File Manager or the FTP program of your choice.

Quite frankly I am shocked and appalled by this. iPage support assured me they made their engineers aware of the issue and are working on fixing it as soon as possible. But suffice it to say... I am looking for a new host provider.

Improve this answer
1
  • 2
    "anyone has the opportunity to install a new instance of WordPress" - although the user must first login, and if WordPress is already installed I think you simply get prompted that WordPress is already installed - I don't believe you can reinstall or install another instance of WordPress at this stage?
    – MrWhite
    Aug 1, 2018 at 19:12
1

Hi to be honest to the best of my knowledge the most common WP hacks are either weak PW security that has been compromised and allowed malicious code / updates to be made (consider the number of WP admins that didnt change the default UN 'wp-admin' thats already half of the auth guessed). Or for historic installs / ones with the offending versions bad versions of PHP thumb of (that used to have a well knowen exploit).

If your site is redirecting at all it would indicate that it has been compromised already and depending upon the method you are using to update it the malicious files (or DB entries) might not be getting touched / deleted.

However there are a bunch of 'remedies' on good old Google but also as with most things WP there are a bunch of plugins that can detect for common compromises. If you can still access your manager it may well be worth trying one of these as a starter..

http://wordpress.org/plugins/gotmls/

Good luck!

Improve this answer
6
  • Thanks, I installed and scanned using gotmls. It did found some vulnerabilities, but they go beyond the scope of my expertise. I was specially suspicious about these files: .../tumblr/wp-includes/js/json2.js .../tumblr/wp-includes/js/jquery/jquery.schedule.js .../tumblr/wp-includes/js/swfupload/swfupload.js But then I have another domain and these same files were included as potential threats too.
    – saul
    Mar 26, 2014 at 4:57
  • Hi also dont forget that if someone does manage to get write access to you web files they can update existing scripts that appear legit. As an after thought if you have been compromised other people will almost certainly have been too. Next time your site is redirecting get the URL it redirects too and try googling "wordpress redirects to xxxxxx.com domain" and see if you get some suggestions like that maybe? Again good luck.
    – megasteve4
    Mar 26, 2014 at 10:39
  • 1
    Also to whoever down voted my answer - fair enough if you disagree with what I am saying but then maybe take the time to explain why and share you views for the benefit of others rather than just blindly down voting.
    – megasteve4
    Mar 26, 2014 at 10:41
  • Just went into my logs stats file. I found a log that seems suspicious. I don't fully understand the structure but apparently it calls for a GET function on wp-admin/install.php, which is where the redirect is happening. Here's the link to that GitHub: github.com/feedjira/feedjira/tree/master Any thoughts highly appreciated.
    – saul
    May 27, 2014 at 20:43
  • Are you parsing RSS Feeds?
    – eyoung100
    May 28, 2014 at 22:37
1

I would upload a fresh copy of WordPress excluding the wp-content folder. Update the core files. Then check your htaccess is correct. It's likely the installation didn't complete. Does iPage have any server side caching which you can manually clear?

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Improve this answer
1

There's no accepted answer, but it's over a year old, so I'm answering for the sake of academia.

If you're checked the database structure, and you've replaced the core files, there's really only one answer that remains: your host. There is obviously some communication issues between Apache and MySQL (assuming this is what your host uses).

Improve this answer
1

This is a year old, but I saw it so I might as well try to answer it as there is no accepted answer (yet).

The most common reason for this is caused by changing your database. For example, my host's database server was down for some time and when it was up again, I had to 'install' it again. In this case, this is expected behavior.

If this is not the reason, there's probably some issue with the installation. For example, it failed but you can't see it.

A bit off-topic, but I would also highly recommend not to use iPage -- even if there were no files I think they'd still say 'nothing is wrong'.

Improve this answer
1

In my experience, this error can happen when your web page makes too many requests to your host server, especially if you are on a shared server.

Improve this answer
1
  • Such a short answer is not high quality, especially when your grammar is poor. I can correct some of the grammar, but can you edit this to expand it? A link to some documentation about it would go a long way to improving the quality.
    – Stephen Ostermiller ♦
    Jun 21, 2017 at 15:04
1

It is because MAX_USER_CONNECTIONS or MAX_QUERIES_PER_HOUR exceeded. If you are using a free hosting than you can't increase the limit. But if you are using paid hosting tha you can increase the limit. For more information visit https://dev.mysql.com/doc/refman/5.7/en/user-resources.html

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.