Jody Hatton

Thanks for the unexpectedly turbo reply!

The site is using PayPal Standard … but this is the message that appears after a successful purchase.

http://xdude.com/temp/after-purchase.png

Only way to fix this: get an SSL certificate?

Thanks for the reply!

I assure you, I am most calm. 😉

With all the hype and doom-and-gloom about the XSS hack last week, it appears (so far) to have been more bark than bite.

Of course, I understand it’s very bad if an anonymous person can gain admin access to a website. But if they don’t actually do anything … ?

No content deleted, no new posts or pages, nothing.

No files modified, no apparent scripts running.

Would scanning the database for a certain string expose anything? I guess it’s a matter of “who” hacks the site, not everybody would have the same motive.

Anyway, do I understand the guide correctly that the person may still be able to log in with their valid cookie, even if I’ve deleted the user? Or no?

Other than that, I don’t think any of the guide really applies.

I have a super-duper .htaccess file that already blocks access to various files and directories, but there were a couple things in the “security measures” link that I can add.

Thanks again!

bah!

It was a plugin I was using, called “Custom Post Order” – it must have updated recently and started overriding all pages on the site (rather than on individual category pages). I unchecked “Apply to all categories” and the home page went back to normal.

Thanks. 😉