Resolved issue with a disappearing site

[jorge ceballos]

Server operating system version

centos 7

Plesk version and microupdate number

Plesk Obsidian 18.0.52 update 3

Hi,
One of my personal sites I use for work which was ok last night, today showed 500 error index page.
Reviewed PHP version and it had been switched to 8.1 (!) from 7.2
Reloaded from a direct link and only a white screen showed.
Tried again but this time typing the whole url and the top part of the login page showed for a second and dissapeared, leaving again a white screen.
Tried it plenty of times, all with the same result.

The site works as I could see an image in my mail from a html link sent from the site, but won't show on line is if you type the URL as its suppossed to; only the white screen.
Made sure my IP is whitelisted and disabled mod security and still nothing.
Googled and found that sometimes .httaccess become too strict, so disabled all the .htaccess files' "deny" sentences in the site ... to no avail.

Any idea?
Please help, need it working first thing in the morning.

TIA

 

[Peter Debik]

Hi @jorge ceballos , if you did not switch PHP versions yourself, maybe your provide deactivated the old PHP version and switched you to the new one? PHP 8 has many differences compared to 7.2. It is quite common that websites won't work on it unless they are udpated to the latest themes, plugins etc. Have you considered checking into "Logs" to see what error messages are shown for the site? If PHP 7.2 is still available from your PHP menu, you could also consider to switch back to 7.2 (temporarily).

 

[jorge ceballos]

Hi Peter,
All php 7 versions are there, as well as php 8.
Yes, that was the first thing I tríed, switched it back to 7.2 and it was then that the header showed for a sec and dissapeared. (keeps doing it).
The only error in logs were regarding the new syntax needed to run the script under php8 and nothing else.
The weird thing is that the script worked daily for over two years w/o a glitch. We know it must be translated to php 8 but that will be some other time this year.
My guess is that its something regarding an activated security rule but what and where is it?

 

[Peter Debik]

If you can see the page and a moment later it disappears, a Javascript script overwrites style settings on the page. This can have several reasons. One can be that the browser still has an outdated version of a script in its cache. Solution: Clear browser cache. Another can be that the script itself has been compromised or is faulty for another reason. Mitigation approach: Find out why the the PHP version suddenly changed. It could be a result of a successful hacking against your account. Then also check the results from ImunifyAV scan of the website.

 

[jorge ceballos]

Thanks @Peter Debik !!
As usual, you were right.
Httpdocs and subdomains were infected with tampered htaccess and some other files which came to block the script located in a subdomain.
Though ImunifyAV showed the site to be clean, couldnt find a way to run ImunifyAV through all these folders and files which were not identified domain/subdomain folders created by Plesk - would be great to have it scan the whole domain root folder.
So, at the end we just deleted httpdocs and subdomains folders, recreated them and uploaded the script.

Amazing, first time in over 5 years we spend less than 48 hours without WAF - this time due to Atomic's rules problem and we got hit!

Thanks a lot again,
Regards