[Ultimate] 4,131 Word Guide: How to Fix Every WordPress Error, Bug, or Hacked Site

Theme Install Failed

Installing a new theme for your site can often feel like opening presents on your birthday. Because of this, there are few things worse than opening your ‘present’ and seeing that pesky ‘Theme Installation failed’ screen with the error ‘The theme is missing the style.css stylesheet’ on the screen.

Although your first instinct may be that you’ve been duped, that usually isn’t the case.

How to fix “Stylesheet” error:

Step 1: Locate the theme on your desktop, unzip, and open it.

Step 2: Make sure all of your files are there, then zip it again.

Step 3: Upload via WordPress OR upload unzipped file via FTP.

This fix seems very straightforward, but if you need some more guidance you can check out any of these links:

Theme is missing the style.css stylesheet error

Solving Broken Theme Issues

How to get rid of ‘Stylesheet is missing’ error

Theme Doesn’t Look Like Demo

In a perfect world, every theme homepage looks exactly like its demo, and there is never any confusion in installation. Unfortunately, we don’t live in a perfect world. Themes are fickle little things, and one accidental click of your mouse can change the entire look of a theme you just spent your good, hard earned money on.

More often than not, these issues are caused by a static page issue, so it’s an easy fix.

How to fix theme demo problems:

Step 1: Go to the ‘Template’ option under ‘Page Attributes’ and look to see if there is a Home or Homepage template option.

Step 2: If so, create a page using this template.

Step 3: Go to the ‘Reading’ option in your settings and set it as the static page option.

A few helpful links:

How to create a static front page

The Beginner’s Guide to Setting Static Front Pages in WordPress

How to Create a Regular Static Website Using WordPress with Optional Blog

Sidebar Below Content Error

This is a weird one to get, but also incredibly common. You may think that your theme is completely ruined and there is no salvaging it, but that’s not the case. It’s usually a simple HTML or CSS error in your theme, like an unclosed div element somewhere.

Think about what you’ve added to your theme recently. If there is a plugin or some other HTML change, the fix is going to be an easy one.

How to fix sidebar error:

Step 1:Use a tool like W3 Validator and see if your HTML is the cause of the error.

Step 2: Chances are that it is. Once you see where your problem lies, you can go about changing it. This is the easiest way to go about fixing it.

If your HTML coding isn’t the issue and W3 returns no errors, you probably have a proportions issue. For help in fixing this, check out any of this link:

Sidebar jumping below content

Memory Size Exhausted Error

Is there anything worse than getting a memory error when you’re trying to work on your website? No, probably not.

This error usually pops up when a PHP file is processing more than its allotted limit. It could be for a number of reasons, ranging from too many plugins to a memory-sucking site theme. Whatever the case, you need to be able to increase the memory of your site if you want it to be accessible and error free.

How to increase PHP memory in .htaccess:

Step 1: Configure your .htaccess file and add the following line to it: “php_value memory_limit 64M”.

Step 2: If you are running 32M, try changing it to 64M. If you are already running 64M, try 128M.

You can also change your PHP memory in wp-config.php and PHP.ini. Because a lot of this depends on the method you are going to use to increase your PHP, I will leave a few helpful tutorials here:

How to Increase Your PHP Memory Limit

Increase PHP Memory

How to Fix Allowed Memory Size Exhausted Error in WordPress

Error Establishing A Database Connection

There is no single fool-proof reason for getting this error. It could be because your login credentials were changed, but it could also be because your servers are down.

Most often, it’s some kind of server error.

How to fix database connection error:

Step 1:Head into your WP-admin and see if you are getting the same error there that you are on your site.

Step 2: If you are getting the same error message, there is most likely a problem with your server. I recommend calling your host. They are more equipped than anyone to figure out what’s going on, and if it’s something that they can fix they’ll let you know.

Step 3: If you are getting a different error message in your WP-admin, you may need to repair your database.

This is a very complicated issue with a lot of variables, so I don’t suggest doing anything without talking to your server first. That being said, if you want to try your hand at figuring this out on your own, you can check out any of these tutorials:

How to Fix the Error Establishing a Database Connection in WordPress

How To Fix “Error Establishing A Database Connection” In WordPress

Fixing The Dreaded ‘Error Establishing a Database Connection’ in WordPress

Getting hacked is every website owner’s worst nightmare. I wish I could say that it never happens, but that would be a blatant lie. The truth is that as soon as you become a presence on the world wide web, you become vulnerable to cyber hackers and their malicious attacks.Whether your site is being used to spam with useless information or you are the victim of a virus doesn’t necessarily matter — the attacks hurt your site and its reputation all the same.

As a matter of fact, according to Forbes, nearly 30,000 websites are infected with malware on a daily basis in 2013. By 2015, we learned that nearly 1 million new malware threats were released on a daily basis.

Let that sink in for a second or two.

Daily. Basis.

Way back in 2011, in a survey by ComputerWorld, it was estimated that 90% of businesses have been hacked at one point or another.

Five years later, I don’t think those numbers have changed all too much. If anything, they just may have increased.

Just a few days ago, the Armscor website was hacked by the well known group that refers to themselves as Anonymous. Thanks to the hack, over 64MB of data was leaked to the public.

If it can happen to them, it can happen to anyone.

As safe as WordPress is, and as hard as WordPress employees try to keep their users protected, there is no way to completely protect from vulnerabilities.

WordPress plugins make up for more than half of the WordPress vulnerabilities count at 54%. That’s a scary thought.
Although you can never know for sure just what caused a hack, you can familiarize yourself with the most common techniques and take steps from preventing that from happening to you.

These are the steps you need to take today to prevent your site from being hacked.

Step 1: Identify the problem

Before you can begin to fix the issue, you need to know exactly what is going on with your hacked site. Can you still log in to your site? Is it being spammed with irrelevant links? Is Google saying your site is insecure? Try to find out as much information as you possibly can, as this will be helpful with your next step.

Step 2: Change your passwords and contact your host

If you are involved with a hosting company, it’s always a good idea to go to them first and foremost. They are basically trained to deal with this sort of thing, and their knowledge will probably far exceed yours.

Tell them all that you have been able to figure out on your own and get their advice. More often than not, they will be more than willing to help you out.

It is EXTREMELY important that you change your password immediately. You want the hacking to stop, so it is important that you cut them off as soon as you find out that you have been attacked.

Step 3: Restore a backup

This can be a frustrating step if you haven’t established a backup procedure prior to getting hacked. Luckily, a lot of servers provide automatic backups (including WPEngine), so check your web host if you don’t have a backup in place.

When your computer starts to fail out on you, people always recommend that you restore your settings. It really isn’t much different for your WordPress site. Once you have been invaded by a hacker, there isn’t much you can do besides restore your backups.

If you have a backup plugin (one of the most popular on WP is Backup Buddy), all you have to do is restore to the last backup you have before the attack, and you’re in the clear.

For some step by step help, check out this tutorial.

If you don’t have a backup program in place, or if you don’t want to risk losing posts you’ve made since your backup, this may not be the solution for you.

Step 4: Scan for Malware

Now it’s time to do some serious cleaning up. Start by deleting any and all inactive plugins and themes on your site. Chances are that this is where the hacker is hiding out.

For more information, check out this detailed tutorial on how to find the culprit. Next, make sure to secure your .php file to make it so this can’t happen again.

Once your files are secured, it’s time to run a malware program. Sucuri Security comes as highly recommended plugin.

Step 5: Change your secret keys

Here’s the thing: even if you change your password, your hacker will remain logged in until you change your secret keys because their cookies are still valid. In order to give them the boot, you need to create a new set of secret keys.

To do this, check out the WP key generator here, then update your wp-config.php with the new ones.

Step 6: Update WordPress & change passwords (again)

Now that you’ve hopefully been able to remove the virus, prevent the hacker from getting back in, and secured your site a bit more, you’re almost done!

Make sure to update to the latest version of WordPress so that you are able to stay more secure. I would also change my passwords one more time, just to make sure you’re starting off with a fresh hacker-less slate.

Top 10 most common hacks you should familiarize yourself with:

1. SQL Injection

What is it? This technique is most often used to manipulate a website’s database and steal their logged usernames and passwords. It is most commonly used on websites like WordPress, which makes it a legitimate vulnerability for bloggers.

The SQL injection preys on improper coding. Once the SQL is injected into any log in form, the information can be tracked, logged, and manipulated to the hacker’s content. They then have near unlimited access to your site’s complete database.

See, most log in forms look something like this when they are in code:

The interpretation comes when the username and password are entered respectively, and the interpreter will decide whether the user can and should be logged in based on the information they have inputted.

However, in the case of an SQL injection, the hacker will change that code to look something like this instead:

The addition of the “OR 0=0” is the main difference here. In other words, this code change basically says, “allow users in whose usernames are xx or if 0 equals 0.

No matter who you are or where you are from, 0 will always equal 0. I think we can all agree on that. So it’s no surprise that the hacker will be granted access.

How can you fix it? Fixing these kinds of attacks is about as easy as removing all of the vulnerabilities in your website. If that seems like a simple task to you, then great! If it seems like something that could potentially make you want to rip the hair out of your head, don’t worry.

In doing some research on the subject, I noticed that the most common practice to rid yourself of this vulnerability is to head over to your .htaccess file in WordPress and add a few lines of code.

If you are uncertain as to how to find your .htaccess file, look here.

These will prevent the harmful code from being interpreted at all, thus cutting your hacker off almost instantaneously.

You can find the code, which was written originally by ESecurityPlanet, below.

2. File Inclusion

What is it? Two different file types are included in this vulnerability: Local and Remote.

Local file inclusion, which is usually referred to as LFI, is a vulnerability in which local files (or files on the current server) are included in an attack through either a script on the server or the use of user supplied input without validation.

Remote file inclusion, or RFI, is similar in nature, but it includes an entire remote file. These vulnerabilities are most often caused by PHP, notably the include and require statements in the code. More often than not, hackers will take advantage of novice site owners who don’t recognize the full capability of programming, and use their ignorance to include malicious coding into the variable.

For example, let’s say that a site has two photo options in it: kittens and puppies. For the sake of this argument, let’s pretend that the code looks something like I’ve included below.

The site owner intends to use those two photos only of kittens and puppies, and includes those in a PHP. The reason this is an issue, however, comes when a hacker can access these files.

Why, you ask?

The inclusion of this one single line of code into that PHP will inject a remotely hosted file that contains malicious code. That’s all it takes.

How can you fix it? It may seem like a tedious task, but that’s because it is. The only way to completely guarantee that all local and remote file inclusion is held at bay is to remove all dangerous code from the variables.

What does this mean exactly? Manually go through your received input and only accept characters and numbers for file names, A through Z and 0 through 9. Any commas, periods, exclamation points, or other questionable symbols should be removed immediately.

Then, to prevent directory traversal, limit your application program interface to allow the inclusion of only one directory.

3. Brute force attacks

What is it? Just about the most common form of hacking comes from a brute force attack. It more or less means that hackers will continue to try to log in to an account by continuously trying passwords until they are able to get in. By using proxies, they are able to avoid that dreaded “you have attempted to log in too many times” screen that we’re all so reluctantly familiar with, too.

Let’s pretend for a moment that I want to hack Brad Pitt’s WordPress site, but all I have is his username ‘bpitt’. Perhaps I will first try the names of his wife and children. Then some of his popular movies. Then his mother’s name. Once I run out of options (or if I know nothing about Brad at all), I may even enlist the help of a password list.

These text files, created by hackers and shared among one another on popular hacking forums, include thousands of popular passwords all compiled together. With proxy in place, a program can run the .txt file until it finds a password match.

Once it does, I have cracked into Brad’s account.

How can you fix it? Fixing it is pretty darn easy, and takes no longer than five minutes. Change your password and don’t make it so easy! Although you may have originally believed that “coffee” was a difficult password to guess, it isn’t half as difficult as it should be.

Change your password to include at least one uppercase letter, one number, and possibly even a symbol. People are far more likely to guess “angelina” as Brad’s password than if it was something like “AngelinA993!”, don’t you think?

4. DoS attack

What is it? A DoS attack, better known as a “denial of service” attack, occurs when a hacker bombards a website with hundreds of requests in a short amount of time. These requests bombard the system and suck all bandwidth and resources from the site, leaving it with absolutely nothing to run on. In turn, the websites services are suspended and the site is shut down.

There are several different attack techniques, though most included a distributed attack in which the attack comes from more than one IP source. Typically, it comes from hundreds, if not thousands, of IP addresses and completely overloads the site in a matter of mere minutes.

Think of these attacks as a Black Friday sale. Hundreds of people gather around 1 door and wait anxiously to get out of the cold and into the toy store. As soon as the doors open, all 400 people run inside at once. The result is chaos, stampeding, and unrest. That’s essentially what a DoS attack is, simply in the cyber world.

How can you fix it? Your very first step should always be to call your hosting provider and let them know that your website is under attack. Their data centers have much higher bandwidth than you do, and they will be able to handle the attack with more ease and experience. Always do exactly what they tell you to do, as their first priority is to stop the attack from happening. If you don’t have your hosting provider’s help center’s phone number, make sure you get it BEFORE this happens, as every minute is valuable time that could be preventing this particularly nasty attack.

5. Cross Site Scripting

What is it? This vulnerability, more frequently referred to as XSS, enables hackers to bypass access controls and inject scripts into web pages that they shouldn’t have access to.

By accessing script, the hacker can add vulnerabilities directly to the victim’s links, leading users who trust the victim to click a link that actually leads to a vulnerability.

For example, if I have a website about all different kinds of flowers, someone can easily adjust the script so that a URL appears under the guise of my site. They will lure someone in with the promise of tulips or some other flower, then hide a malicious URL within the script. Site users then click the link, thinking they are getting information about tulips, and are instead taken to the malicious URL.

How can you fix it? Far and away the simplest way to protect yourself from XSS attacks is to pass all data through a filter. This will remove dangerous tags and keywords, CSS styles, HTML markups, and JavaScript commands that could lead to this sort of attack.

You can either filter your material on your own, or use a program to help you along. If you use Java, you may want to consider XSS Protect, which is hosted on Google code. It promises to filter all known XSS attacks from code. There is also HTML Purifier, which is another great option.

Unfortunately, there is no guarantee that safe text won’t be removed because it includes a questionable tag or keyword. There is no way to avoid this without doing your removals manually and using your own discretion.

For a complete guide on how to remove and prevent particularly nasty XSS attacks, check out this in depth tutorial by Acunetix.

6. Cross-Site Request Forgery

What is it? Cross-site request forgery is a vulnerability that allows hackers to force site users to perform actions on the site without their knowledge or consent. Typically, the attacker will coax a victim to click a link or download a picture on the website while logged in to a secure session.

After that link has been clicked and/or the picture has been downloaded, the attacker has full access to do whatever he or she wants under the user’s account for the remainder of the session. This is particularly dangerous on sites that store credit card information and the like, so it is imperative that site maintainers find and remedy these vulnerabilities immediately as to prevent their users from distrusting them forever.

How can you fix it? Implement and include the use of tokens in a user’s session. These tokens, which act as cryptographic values and are extremely difficult to guess, will be generated when a user’s session begins and will be related only to that particular user’s session. The token will then continue to be included in each and every request that the user names to ensure that it is indeed them doing the clicking on the website.

In order for the hacker to gain access to the session, they would have to know the token value of the hacked person’s session, which is near impossible to guess correctly.

For a complete tutorial on how to create tokens and add them to your site, check out this tutorial by WikiHow.

7. Unencrypted Protocols

What is it? Any time a protocol is unencrypted, you are leaving yourself and your users vulnerable to an attack from a hacker. They can take over your site and steal valuable information, such as usernames, passwords, and credit card information, in a matter of minutes.

How can you fix it? Make sure that you use Secure Sockets Layer, or SSL for short, which is the standard security encryption technology.

SSL provides a secure channel between the site maintainer and the user, preventing hackers from being able to get into the secure browser.

8. Clickjacking

What is it? Let’s take a look at the above picture, which I retrieved from Encoders.co.in. The user thinks they are posting a status to Twitter, but in reality they are clicking a link to a malicious site. More often than not, the user is typing on a transparent layer. They think they are seeing and clicking on a website, but they are actually clicking on an invisible layer on top of the website.

For example, let’s say that I believe I am entering my bank information. I enter my username and password, then click submit. In reality, there is an invisible layer and I have just provided my banking information to a third party site who now plans to use that information maliciously.

How can you fix it? Editing your .htaccess file to prevent clickjacking is entirely possible. There are three different options, all of which do three different things:

SAMEORIGIN will allow the page to be displayed in the frame on the same origin as the page itself.

ALLOW-FROM uri will allow the page to only be displayed in a specified origin.

DENY will prevent a page from displaying in a frame completely.

If you need to defend yourself from these attacks, enter the following code into your .htaccess file:

9. Broken authentication and session management

What is it? Authentication covers everything from managing active sessions to logging out When session management and site authentication are compromised, legitimate risks can be forged. All it takes is a site that improperly logs out for a broken authentication session management vulnerability to turn into a real problem and cause a string of issues such as compromised usernames and passwords, session tokens, and site keys.

If you think about it, many sites already take precautions to prevent these attacks. How often are you idle for a few moments, then told that you must reauthenticate your session? That is to prevent these kinds of attacks from taking place.

How can you fix it? Once again, this comes down to password controls. Requiring that your users make more complex passwords can easily prevent this breach from occurring on your site. Furthermore, you can include various other password input methods, such as password change controls and storage to prevent hackers from getting their hands on a user’s valuable information. Plugins like WordPress Password Policy Manager will require that your WP users have a strong password with various “rules” implemented.

10. Remote code execution

What is it? Remote code execution is when a hacker gains access to a victim’s computing device and makes changes, regardless of the distance between them geographically. More often than not, the hacker will include malicious code into the victim’s website and take complete control by removing the victim’s privileges altogether.

How can you fix it? This is a very serious issue, as it not only affects the victim’s website but their entire computer. There are several steps that must be taken to counteract this problem, and I highly recommend that users who fear they may be suffering from an RCE attack head oevr to Symantec’s site and read up on their tips to remedy this.

Some Tutorials to help if you’ve been hacked:

FAQ: My site was hacked!

What to Do When Your WordPress Has Been Hacked

Step by Step Guide to Fixing Hacked WordPress Site

How To Recover A Hacked WordPress Site