A few times now, our site's DOMAIN_CURRENT_SITE constant, stored inside wp-config.php has been overridden by what appears to be a reverse DNS of our sites IP address... Since we use AWS elastic IPs, this turns out to be something like aws.12345146.someothertext.aws.com instead of www.ourdomain.com. When this happens, the site becomes unreachable.

The DOMAIN_CURRENT_SITE value needs to be reverted, and we also need to run a few updates on the database to restore some urls there.

The last two time this has happened it was Friday morning, so we suspect an automatic update (plugin perhaps) or process. An audit log plugin shows Yoast SEO and Gravity Forms updated early this Friday, but nothing appears for the Friday prior, so that may be a red herring.

Logging is currently disabled and I can turn it on, however I would like to reserve allowing the site to fall over again next week only as a last resort, as when that happens it is a Bad Thingtm.

I can submit a request to change the reverse DNS result for our elastic IP however I would prefer to fix the cause of the issue rather than the symptom.

Anyone have any ideas?

Update: to re-iterate, the database also needs an update run to remove the new url in a few places, meaning I can't only make wp-config.php read-only and call it a day... the db changes are, specifically:

UPDATE wp_options SET option_value = 'http://www.ourdomain.com' WHERE option_name IN ('siteurl', 'home');
UPDATE wp_site SET domain = 'www.ourdomain.com';
UPDATE wp_sitemeta SET meta_value = 'http://www.ourdomain.com' WHERE meta_key = 'siteurl';
UPDATE wp_blogs SET domain = 'www.ourdomain.com';

I've installed a cron viewer for wordpress scheduled jobs, and snapshot-controller-full-cron-start_backup is run 1am Friday mornings, and may be the cause. Haven't been able to locate and further info.

  • is the file writable by the websever? if so, you need to change that, if not you should start digging into your OS cron settings to find the process that doen it (or AWS setting maybe) – Mark Kaplun Feb 17 '17 at 4:49
  • @MarkKaplun The file is writable - I've changed this, but still concerned about the wrong url being inserted into the database. There are no cron jobs on the server itself, but I'm looking into a plugin (wp-crontrol) that shows some cron processes within wordpress itself, and I'll see if anything comes up – Numeron Feb 17 '17 at 5:10
  • It's not enough to just make it readonly, you also need to figure out, who or what was changing it. Otherwise you may have a bigger problem in the near future. – Fayaz Feb 17 '17 at 6:15
  • @Fayaz, while I totally agree with the sentiment (and usually I am the first to point it out ;) ), sometimes there are just things beyond your control or knowledge depth. As long as it is not an obvious malware, there is a cost associated with finding the root cause which is hard to estimate (maybe it is some AWS setting on control panel somewhere). Think about it differently, if the file was readonly in the first place, you would not have known there is a problem you should look for ;) – Mark Kaplun Feb 17 '17 at 8:30
  • @MarkKaplun: Yeah ignorance is bliss! So in that case I'd be just happy. But personally speaking, once I discover that something is changing my files when it's not readonly, I don't think I'd be able to shutdown that thought & sleep well at night ;) But you are right about the scenario, not everyone can afford to do that. May be it's a trivial matter or may be Tim lost his keys again :D meta.stackexchange.com/a/215397/349778 – Fayaz Feb 17 '17 at 8:56

Make your wp-config.php file readonly or define those constants in a different file that is readonly and then use include()?

| improve this answer | |
  • Thanks, while I have followed this advice and made the file readonly, it still isn't quite enough because the new url is also inserted into the database, please see update above – Numeron Feb 20 '17 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.