Origin Error on wp-admin page

ab123

Hi all,
My Wordpress website was hijacked a few days ago and i'am talking with the hosting provider (likuid.com) to get it back up and running.
I managed to upload a backup of the website from 2 days before the hijack (everything was working fine) and the client side seems to be working but I keep getting "Origin error" when I go for wp-admin.

I have disabled all plugins and switched to an out of the box version of the twentytwentythree theme and still same result "Origin Error" for wp-admin.

The web site is really slow to load on regular pages (sometimes giving me an "origin error" on a random page) but I keep clearing the cache every time I do something so I am not sure if this is the reason for it to be so slow. One thing I noticed is there are still some asian writing in some ads which never occurred before (the hijacked website was part asian part english, see image)

I have 3 websites with this provider which are also on Ezoic, all were down after the hijack but 2 I managed to get back OK and are know working perfectly (the hacking was much less severe for these two).
I have been at it for 3-4 days now and am running out of ideas, could someone from Ezoic let me know if all is clear on their side ?
Thanks
Alexandra

JeanPierre

Thanks for reaching out! If you're seeing the site down on the front end, you may want to make sure your DNS records in Ezoic match that of your hosts. If the issue is only in the backend, it may be useful to whitelist the following IPs, then let us know once complete so that we can make configurations on our end.

52.20.63.25
3.225.202.138
3.217.200.190
54.212.71.227
52.12.170.68
34.218.21.81
3.7.90.144
13.127.240.219
18.139.6.69
18.140.184.0
3.106.6.164
3.106.176.6
13.237.131.67
15.222.77.144
15.222.108.52
18.157.131.187
18.157.105.182
3.126.25.160
34.248.174.237
52.16.85.139
34.255.61.232
15.236.165.82
15.236.137.228
15.236.166.30
18.228.20.129
18.228.107.195
2600:1f10:4c55:e200::/56
2600:1f13:393:600::/56
2406:da1a:e10::/56
2406:da18:9d0:1400::/56
2406:da1c:58a:e100::/56
2600:1f11:f39:6f00::/56
2a05:d014:776:a600::/56
2a05:d018:dd:7800::/56
2a05:d012:4d8:6800::/56
2600:1f1e:342:2f00::/56

ab123

Hi Jeanpierre,
Thanks for the answer.
DNS are all good.
The issue is mainly with the backend (I haven't been able to access the wordpress dashboard through wp-admin), but it also happens on the frontend some times.

I'll ask the host for the whitelisting and come back to you
Thanks
Alexandra

JeanPierre

In that case, whitelisting the records should allow for this issue to resolve!

ab123

Ok so the IPs have been whitelisted by my provider,
I cleaned the ezoic cache and all plugins are disabled, but I still can't access wp-admin. I get "origin error" and the other pages are really slow sometimes giving me "origin error" too.

Thanks

MichaelH

If you have already whitelisted, could you please set up an X-Forwarded-For-Header?

The X-Forwarded-For Header is a header field that you can use to make sure the 'real' IP of your users is passed along by a proxy like Ezoic or Cloudflare. This is especially helpful for specific features (like login forms) that need to see the original user's IP. You can add this header to your server (and let your host know that they need to look for it and authorize requests on that basis), or ask your host to do it for you.

You can find instructions for implementing X-Forwarded-For on your site here.

ab123

Hi Michael,
Thanks for your answer.
I have implemented the X-Forwarded-For Header in my wp-config.php (beginning of the file), my provider is asking for some instructions on what you expect him to implement on his side.
Thanks Alexandra

AnyaR

Hi there,
Via the XFF header, Ezoic will send the IP address of the visitors on your site, your host can refer to these IP's to ensure that the traffic coming to your site is not bot traffic. This will prevent any confusion and should stop requests being blocked.

ab123

Hi AnyaR
Thanks for the answer, I forwarded to my provider and will let you know when its done.

I do have a related question.
I have 2 other Ezoic websites (using Ezoic DNS and cloudflare) with the same provider on the same shared plan as zebestcoffee with all files in the same public_html dir.
They have absolutely no origin error issues and came back from the hack with the same loading speed as usual, no wp-admin access problems and without any need of whitelisting Ezoic IPs or XFF headers.
For convenience and easier maintenance, I set up all 3 Ezoic websites with pretty much the same architecture and design (same theme, options, and plugins) with few differences which I try to minimize.
How come they are not affected by the Origin errors?

Thanks
Alexandra

Lilla

ab123 Hey there, hope you're doing well.

Just so you're aware, I have temporarily disabled the Ezoic cloud on your site - as in doing so, I believe the site should be working again. It, unfortunately, won't show ads (or have other Ezoic changes on it) until we can re-enable the cloud, but it should at least allow you to see your content.

I've looked into this quite thoroughly, just to make sure we haven't missed anything and it does still seem like we are dealing with IP blocking.

The reason that this can happen on one site and not others, is that the process is very dynamic. With a standard hosting set-up, your host's server will be connected to by a very wide range of IPs (typically, one unique IP per user). However, when integrated with Ezoic - all requests to your host are actually coming from our proxy, so your host will see a much narrower range of IPs trying to connect. Some security systems will flag this influx of connections from a specific IP as being a potential bot / DDoS attack and will block the connection. This is done dynamically, without adding the IPs to a blacklist. You may not see this on all of your sites; but the risk of it happening is there, if the fix isn't implemented.

Hope that makes sense. Let us know how the above goes. 🙂

-Lilla

ab123

Hi
My provider is asking exactly what he should do on his side with the XFF header "to look for it and authorize requests on that basis". Can you provide a detailed procedure.

Can you explain why my other Ezoic integrated websites are not affected by the "origin error" problem.
Thanks
Alexandra

ab123

Hi Lilla
Thanks for your answer !
OK so the site is back working! No more Origin error, and its pretty fast! And I finally have access to wp-admin. Thanks.

I think I get the problem. Until now it was kind of in balance with something the hijacker might have left in a file somewhere. Now its clear the site is working perfectly and the problems come when the Ezoic cloud is activated.

Can you give me a procedure that I can forward to my provider so that he can implement the use of XFF header on his server and stop blocking the Ezoic IPs. I have been at it for more than a week now and it does seem to all come from this.

Thanks again
Alexandra

cjsmith

Hi Alexandra,

There is no set procedure for dealing with this - it depends on the hosting provider and how they process requests from a proxy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For. Essentially, they just need to find the user IP via the XFF header and authenticate requests coming via Ezoic's proxy based on this IP address as opposed to Ezoic's but if it's not something they've handled before, then unfortunately this is likely going to be a dead end.

That said, whitelisting our IPs should have taken care of this issue anyway. They have definitely done that?

It's possible that something else other than your host is blocking requests coming from Ezoic. Could you let me know whether you have any security plugins installed, such as Apache, Jetpack Protect, Wordfence, BitNinja, ModSecurity etc.? Particularly if there is one that is installed on this site but not your other two.

ab123

Hi
Thanks for the answer.
I just have "All In One WP Security" plugin which I disabled when I started to try and sort things out (plus its also on my 2 other Ezoic integrated websites and poses no problems).

As far as whitelisting Ezoic IPs, its supposed to be done.
Thanks
Alexandra

ab123

Hi there,

I just had a feedback from my provider saying "can you check if its working now? We were able to add the ips to the whitelist correctly" 🙂

As of now (not on Ezoic cloud), the website works perfectly with all plugins active (including "All In One WP Security").

Thanks
Alexandra

MichaelH

Glad to hear! Please let me know if you come across further issues.

ab123

Hi there,

Sure this is good news, but your tech Lilla " temporarily disabled the Ezoic cloud" for my website. Can you please put it back on the Ezoic cloud or point me to the procedure for doing this without losing prexisting Ezoic ads configuration.

Thanks
Alexandra

ab123

To be clear:
1/ site was hijacked + files of my 2 other Ezoic integrated websites where messed up
2/ I plug holes and replace all the files of all my sites with a backup pre-hijack
3/ 2 websites comeback online no problem (Ezoic ads and integration included) , the third keeps throwing "origin errors"+very slow
4/ I tweak everything I can think off with help of provider ==> no changes
5/ I contact Ezoic ==> you ask to whitelist IPs ==> I ask provider ==> he tells me ok done ==> no changes
6/ Ezoic disables Ezoic cloud ==> pre-hijack backup website works like a charm
7/ provider tells me "We were able to add the Ezoic IPs to the whitelist correctly, please test again"

My takes:
1/ my website works fine
2/ Ezoic cloud or Ezoic cloud handling by my provider is source of problems
3/ The provider seems to have finally implemented the whitelisting of Ezoic IPs ()/

I would need to have the website back on Ezoic cloud to see if it works now.
You disconnected the cloud from your side, is there a way for you to put it back in place as everything was before disconnection. If not what is the procedure to get things back up and running for Ezoic ads.

Thanks
Alexandra

Lindsey_

Hi there - Lindsey here. I hope you're well!

No worries - if your host has managed to implement the fixes we mentioned previously (i.e. whitelisting ezoic IPs) then this should be fine :-)

I've gone ahead and turned your site back onto our proxy now. Can you let us know if you're seeing any issues with the site or with your WP-Admin now that this has been enabled?

ab123

Hi Lindsey thanks for your answer,

Oh well it's back to "origin error" for front-end and back-end! No web page reachable whether regular or wp-admin.
Ezoic IPs are supposed to be whitelisted
I have told my provider waiting for an answer

Alexandra