annrochelle

Thanks for your reply. We did restore all lost work and now want to ensure it doesn’t happen again.

Is there a way to search our site to see if anything is giving instructions to Heartbeat other than WordPress itself?

We have no custom code like that – only custom mega menu code, and assorted code snippets for styling details. All custom code is over a year old, not recent.

Found info about manually configuring or disabling Heartbeat in the theme’s functions.php file. Checked both our Divi theme functions.php and active child theme functions.php and there’s no mention of Heartbeat.

Just installed the Heartbeat plugin – but don’t know if it will override other code, i.e. is it loaded first or last. I’ll run a test with the other admin user. To find out if he sees the “Another user is editing this post” lock message with, vs. without, the Heartbeat plugin active and configured to allow Heartbeat everywhere on the site.

Hi,
Yes, sorry I didn’t mention that. When all 404-related plugins are deactivated, the regular 404 error page displays site-wide.
I just posted a new GitHub issue and included an excerpt from X Theme’s support ticket where they narrowed it down to a function that may be at the root of the issue.
Thanks,
-Ann

Thanks.
Update and resolution just FYI:

More problems emerged in the days after this one, including daily backups firing twice not once per day, plug-ins including WordFence giving reports for nexlan.com.routing.wpmanagehost.com in addition to or instead of nexlan.com (wpmanagedhost.com seems to be an anonymous site trying to pass itself off as a hosting provider, but a slightly older version of our site was indeed live there, much to my surprise), plugins alerting to things like a broken link but when I logged into WP there was no broken link, etc. Wordfence and Gravity Scan confirmed no hacks.

The cause turned out to be that our old hosting company hadn’t cancelled our account. They then did so and told me the exact time they did it, and instantly the “clone” site disappeared and all problems ceased aside from some needed cleanup to reconfig a few plugins.

So I believe your DNS alert issued from the copy of Wordfence that was running on the live “clone” site. This would also explain why our current hosting company found no DNS issues on our live “real” site.