It seems that certain lines added to our wp-config.php file are being removed, every day at 01:00.
The line that's being removed is
define('WP_ENVIRONMENT_TYPE', 'staging');
Which is added just before the /* That's all, stop editing! Happy blogging. */ line.
The site is hosted on WPMU, and they say there's nothing they do that would do this. Our WP developer who created the theme says also there's nothing that would do it either. I also can't find anything in any plugin that would do it.
I've checked the cron jobs listed and there's a bunch of WP_Defender jobs, for example, that I have no idea what they do, but they don't seem to run at the correct time for the activity (nothing seems to fire around that time).
I haven't disabled all the plugins and re-enabled them, as we'd have to do it one per day and it would take a month!
Any ideas how I could track down what's doing this?
The first atomated backup, auto-restoring and self-healing wordpress security plugin. Save big from site downtime and costly restoration procedures.
have you checked that WP Defender isn't undoing your change because it's assuming it was done maliciously?