I'm having a truly maddening issue. It may involve plugins (or it may not, I don't know) but I believe it is sufficiently technical to be allowed here.

A few weeks ago, I needed to revert to a backup, and discovered my UpdraftPlus backup had stopped working a few weeks prior, complaining that wp_cron had been turned off.

After many hours, finally I tracked down the caused as a file called object-cache.php in my wp-content folder, which was explicitly turning off wp_cron, so that I couldn't back up at all, even manually. I couldn't figure out (at the time) where that file had come from, or what it was. Removing the line that turned off wp_cron caused a critical wordpress error. I also tried changing the contents of the file to just <?php exit; ?>, and again, critical error.

I did a string search of my entire Wordpress directory for "object-cache" and "apcu" (which is given as a name in that file's comments) to see if I could find what created it. No dice.

So I deleted the file.

A few days later, it was back again! Same problem again, backups stopped running. So I deleted it again.

Sometime around this time, my site started going down for hours a day, everything, including other sites I have hosted as named virtual hosts in subfolders on the same shared hosting account. And not just wordpress— No php scripts anywhere on my server, even outside my wordpress sites, would run at all. I called my hosting provider, but unfortunately I'm on Bluehost. If you know, you know. It's been three weeks of upsells and excuses and no fix from them.

After yet another frustrating round of useless emails with my host, I looked, and discovered object-cache.php was back again! I removed it... and wouldn't you know it, everything immediately started working perfectly.

I looked, and my error logs are full of PHP Fatal error: Maximum execution time of 60 seconds exceeded in /path/to/wp-content/object-cache.php on line 436.

I'm also seeing millions of WordPress database error User '[my database username]' has exceeded the 'max_questions' resource (current value: 1) for query SELECT * FROM `wpnf_wfblocks7` WHERE `type` IN (1, 8, 9, 2, 5, 6) AND `IP` = '\0\0\0\0\0\0\0\0\0\0ÿÿØø\Z' AND (`expiration` = 0 OR `expiration` > UNIX_TIMESTAMP()) ORDER BY `blockedTime` DESC LIMIT 1 made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('plugins_loaded'), WP_Hook->do_action, WP_Hook->apply_filters, wordfence::veryFirstAction, wfLog->firewallBadIPs, wfBlock::findIPBlock entries, which I don't recall ever seeing before.

So, right this second, the site is up, but at this point I know that in a few days this fungus will somehow be back again, and I can't keep babysitting this.

I have combed through the past month's browser history, email uptimeRobot alerts about my sites' up and down times, php error_log entries, and even my little screen-reading time tracking utility on my laptop, trying to find a correlation between the beginning of any website outage, and, frankly, anything else I installed, changed, did, or even just opened to look at. No dice.

I've checked for every plugin that might be installing this file. I deactivated all plugins that were described explicitly as page caching a while ago (W3 SuperCache and a few others I tried before that) and it didn't fix the problem. Now I've turned off every kind of caching (browser caching, etc), but in the long run I really don't want to run without any caching.

I checked my .htaccess files to make sure nothing funky was left by the caching plugins I deactivated. Nothing there to speak of.

I even wrote a small "start" and "end" php scripts to log the currently running __FILE__ and record whether object-cache.php existed or not, and set auto_prepend_file and auto_append_file in my php.ini to run them at the start and end of every PHP script, in hopes of catching whatever keeps inserting this fungus into my site, but they had no effect at all, I just couldn't figure out how to make them work. The scripts work when I call them from the CLI but prepend and append aren't happening.

I did set my php.ini max_execution_time = 300 and max_input_time = 600 tonight, where they previously had been 30 and 60 respectively. We'll see what Bluehost thinks about that. Not sure yet if it helped.

I didn't want to make this post even longer, but in case anybody wants to look to see if they can spot any likely suspects, I've posted a list on PrivateBin of the plugins I've got active right now, at https://privatebin.net/?206169e59a5851ad#FmDVpNzgtQJqM1JrnaamMYneAQmgt5K435vPYNmobKRv.

So: any suggestions how I can figure out what is causing this, and/or get back to a working site, with a working caching plugin, that stays up for more than a few hours at a time without me babysitting it or needing to call Bluehost every two days?

Thanks in advance.

  • Does it look like a genuine object-cache implementation, e.g. redis or memcached? Or is it malicious code that's just using object-cache as a way of getting itself loaded?
    – Rup
    Oct 31 at 9:01
  • If it's not, it looks like someone's got a way of dropping the file into your system, either through PHP code already in your site somehow, or through some other exploit on your host. You could change your filesystem permissions so WordPress + the web server can't write to its own files at all, which would stop PHP code creating object-cache, but that may not actually be the problem. (Or just put an empty object-cache.php in place which the web server can't delete, rename or write to.) It's hard to tell sorry.
    – Rup
    Oct 31 at 9:05
  • Thanks. It doesn't look like malware. It looks like a legitimate cache, it's substantially similar to official releases of APCu drop-in, just looks like an older version. A few variables and comments are different, but that's it. And Wordfence has detected no intrusion or malware. And it's appearing on two different sites that are disconnected except for being on the same server. I did try using an empty object-cache.php file, that immediately broke the entire site. I just can't believe there's no way to track or monitor who or what creates a new file.
    – John Smith
    Nov 2 at 6:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.