Dave Naylor

Those few examples you’ve linked to show requests from China. It could be that they are trawling your site for potential weaknesses and maybe attempting to access your site by brute force login attempts. It looks like your site runs Nginx on a VPS so you should be able to abstract your security up to a server level instead of relying on WordPress plugins.

A combination of tools like Fail2ban, req-limiting and geo-ip restricting will slam the door in the face of the attackers. Here’s some reading material:

WordPress login security with fail2ban
Rate limiting with Nginx
Nginx – How to block visitors by country

Doing a manual update means overwriting core files with new copies. You can read about how to do it here:

http://codex.wordpress.org/Updating_WordPress#Manual_Update

That URL produced this:

Forbidden – You are not permitted to browse this site.

Have you tried manually updating your WordPress core files to see if there as an error when you upgraded to 3.9.1?

Isn’t this post a duplicate of this one:

http://wordpress.org/support/topic/breaking-frames?replies=2

I deloused a system last week that had this particular infection. It seemed to restrict itself to files inside wp-content/ other than the wp-config.php file. It was attracted to many files named index.php as well as several theme and plugin files

I noticed that the infected files were all over 24K in size so I ran the linux find command to find files over that size and piped the resulting files to less, ignoring image files:

find . -type f -name "*.php" \( ! -name "*.png" -a ! -name "*.jpg" -a ! -name "*.mo" \) -size +24k -exec less {} \;

I ran a few variations on the file extension just to be sure.

I also found the files with the name “.. ” which you could easily miss. Again I used find to find them 🙂

find . -type f -name ".. "

I also ran diff checks over themes, plugins and core files to see if there were any changes anywhere else.

If you’re sure that you’ve used the correct database credentials, maybe you used a different table prefix in the new wp-config.php file. If that’s the case, your database will have two separate sets of tables and effectively two installations.

Check the file and compare it to what you see in Phpmyadmin.

Edit: typo corrected

It’s possible that your theme shows a certain number of default widgets in the absence of any user configured ones. I would check the code for you but I think your theme is commercial in nature. Maybe ask in your theme’s support forums.