I have a website running the Photocrati theme version 4.9.3 on an AWS t2.micro running Amazon Linux. I use PHP 5.6 with php-fpm and a very recent version of Nginx, compiled with a couple of modules. I have CloudFlare in front of the website, but it accepts connections only from CloudFlare not directly.
One Wordpress 4.5 site running Photocrati keeps going down, because for some reason the siteurl in the wp_options table keeps getting changed to
I can fix it with the SQL below, but it's annoying, causing downtime. I've scripted this so cron runs it every five minutes - obviously this isn't a great solution, but it will do until I can get it fixed properly.
update wp_options set option_value = "https://www.example.com/" where option_id = 1
I have three other sites on the same server that are fine. None run photocrati - they run a variety of other themes. As far as I'm aware nothing has changed that recently - I switched from Nginx to PHP 5.6 around a week ago, but this started happening 3-5 days after I made that change. All the sites run the same plugins, listed below. I've set up the MySQL query log on RDS, maybe that'll give me a hint.
Akismet CloudFlare Contact Form 7 Contact Form DB Google Analytics by MonsterInsights (it just changed its name to this) Remove query strings from static resources Ultimate Nofollow UpdraftPlus - Backup/Restore Yeost SEO
Photocrati support replied and said they don't know what's going on.
I've done site security scans with securi (plugin and website) and Wordfence. No issues found.
File permissions are all set as restrictive as I can get away with while still allowing auto updates and plugin/theme installs via the web ui. I can see the SQL being executed in the database, when I look for anything malicious in the access log there's nothing significant there - an innocuous query hitting a category of the blog.
Has anyone seen anything similar? Any suggestions how to fix the underlying issue? How do I even track this one down? I need to work out which line of code is running that query.
To be clear - I can bring the site up when it goes down very easily, I'd really appreciate help working out why it's happening. I'm an ex enterprize developer so I'm fairly technical, I've been using Wordpress for quite a few years, I'm good with it - I just don't develop for it so I don't really know the problem.
Note that I posted this question on this site first, but someone told me this site isn't for support. I posted it on Server Fault and they moved it back here.