WordPress.org

Ready to get started?Download WordPress

Forums

Posts are being automatically deleted (13 posts)

  1. sojweb
    Member
    Posted 4 years ago #

    I'm having a very odd problem. In my WordPress install certain posts are being automatically deleted at 5:30 p.m. I haven't discerned any pattern as to which posts are being deleted or what days this happens on, but I can't figure out why they're being deleted at all. I hooked into delete_post to see which user was doing it, but it comes back with an empty user (ID of 0).

    It seems like it's some kind of wayward cron, but I don't have any running. Does anyone have any ideas?

  2. elfin
    Moderator
    Posted 4 years ago #

    do you have any plugins installed?

  3. sojweb
    Member
    Posted 4 years ago #

    A few, but none that delete posts.

  4. elfin
    Moderator
    Posted 4 years ago #

    None that are supposed to delete posts ;)

    Anyway go to phpmyadmin or similar and look in your wp_options table for cron see if you can work out what is being called there (or post it here).Then check those functions to make sure they aren't deleting things.

    Additionally - double the check the db to make sure the pages/pots aren't there and just not showing up.

  5. elfin
    Moderator
    Posted 4 years ago #

    Actually just thought of a third possibility - although remote. Are all changes being lost at 5:30? if so then it may be a database backup is being installed at that time every day - might be worth speaking to your web host as well.

  6. sojweb
    Member
    Posted 4 years ago #

    Yeah, I've checked the cron option, and it's empty, but I've disabled the scheduled delete function all the same. It's not that the posts just aren't showing up, they're actually being deleted; I wrote a plugin that sends notifications out when posts are edited, and I've been getting notifications of posts being deleted, which I'm taking to mean that wp_delete_post is being invoked--and they're not just in the trash, they're gone.

    I host the site on a local server, where it's been for almost four years. I've never had anything like this happen. I'm starting to think I should just trash the entire install and redo it... it's due for an upgrade anyway... but something like this happening really worries me, and I'd like to know what's going on.

    I'm starting to think it might be some kind of malicious code running, even though it seems like kind of a weird attack to write. Have you heard of anything like that?

  7. elfin
    Moderator
    Posted 4 years ago #

    No I personally haven't come across it before.

    what do you mean by this:

    but I've disabled the scheduled delete function all the same

    If you're hosting locally, have you got anything else running that accesses the database in any way? (including scheduled backups)

  8. sojweb
    Member
    Posted 4 years ago #

    I put a check in wp-cron.php for that hook so that it skips it; I assume that has the effect of disabling it.

    I've got a bunch of stuff that accesses the database, but nothing that would invoke the WordPress functions for deleting posts. I mean, it's invoking the hooked actions, so the actual delete post function must be being called. That's the part that's strange. I can't figure out what would be calling it, or how.

  9. elfin
    Moderator
    Posted 4 years ago #

    Could you be overwriting the database daily, at a time when it is supposed to be backed up? This does not have to be from within WordPress - it could be something else running locally.

  10. Mark / t31os
    Moderator
    Posted 4 years ago #

    Print out the filter array and see what's hooked onto the delete_post filter/action.

    That should at least give you the names of the functions hooking on, you can then track them back to their originating files.

    Just about to step away from the PC, but off the top of my head i think the var name is $wp_filter, which shouldn't need to be globalised unless you're printing from within a function, in which case you may need to global the var first.

  11. sojweb
    Member
    Posted 3 years ago #

    Sorry for not getting back to you guys sooner. It does have to be coming from within WordPress because the 'delete_post' action is being invoked. That wouldn't happen if the database entries were being deleted outside of WP.

    Thanks for the tip about $wp_filter; I'm waiting for something to get deleted again to see what's hooking into this action. I'll post what I find out.

  12. Mark / t31os
    Moderator
    Posted 3 years ago #

    You don't need to wait for it to happen or shouldn't do, either the action has a function hooked on or it doesn't, i'd find it strange for a function to be hooked on some of the time, but not at others.

    Once you know which functions hook on, it's a simple case of back tracing the function name to an originating file.

  13. sojweb
    Member
    Posted 3 years ago #

    Yeah, I find this whole thing very strange. There isn't anything unusual hooked at the moment, but these deletions only happen during cron jobs, so maybe something gets hooked in at that point.

    Of course, it's possible that whatever's doing the deleting isn't hooking into anything, in which case it wouldn't put anything in the filter array. For that reason, I'm also dumping a full backtrace when posts are deleted.

    At any rate, when it happens again, I'll (hopefully) know exactly what happened, if not how. This has been a very, very strange problem.

Topic Closed

This topic has been closed to new replies.

About this Topic