Website updates: I accidentally deleted all of my progress

The call is coming from inside the house.

Since my last post, I’ve committed to the Wordpress switch. I wasn’t sure how that would go, given it’s been years (since my editor-in-chief days at The Mirada) since I’ve used it seriously. Even that was just posts, considering it was journalism-focused. But, ChatGPT let me know about “Elementor” which offered a lot of the same amenities I’m used to with the $167/two-year service. Of course, that pays for hosting too, but we’ll get to that.

I’ve since cancelled the hosting plan for nalvarez.net, which now hosts a “Coming Soon!” page for whenever I get to that. Parallel to this, I wanted to rebrand my DJ website, from “me” to “Nightclub me” and “Private events me”, which of course requires a separate website. Naturally, I spun up another Wordpress container for the DJ website and began a faithful recreation. Over the last couple weeks, I slaved away, carefully replicating every element, text box, and photo. Now, with the 4th of July weekend, I wanted to get some more work done on the site – this time on my personal laptop.

To my surprise, as I logged in, pages started being deleted, plugins were activated and deactivated, and shit just went haywire. Trying to restore the deleted pages just brought more despair and suffering – they were permanently deleted, the site reported.

What just happened?

Having already accepted that my site was gone, since I didn’t have backups setup yet, I got to work trying to figure out the root cause. Was I hacked? Site was compromised? A jealous and malignant ex found my logon credentials? None of those were my problem, though, as I was soon to find out. Logging in to the server, I killed the Wordpress instance that was running and started fresh.

Before I did anything, I set up a robust backup solution. By robust, I mean backup everything that container touches. No more Docker volumes, we’re going straight to bind mounts. I’m not messing around with “where did they put the volume”, I want direct access. My script, now running weekly, will take an entire backup of the container and everything it touches, which will soon be synced to my other server in Sacramento.

After completing the initial site setup, things appeared OK. I installed the Elementor plugin. I start editing the first page, even, and all looks well. It was only when I saved and exited, heading to the Plugins page. Activating a second plugin deactivated the first. Activating the first deactivated both. Huh, that‘s odd, but not unlike what I saw before. So that’s not good, but it means I wasn’t hacked or anything. Jumping over to the Pages area, it all appeared normal, but after a refresh, some of the pages were in the trash. Clicking the “restore” button would throw an error, but still restore the page. Clicking the “trash” button on a regular page would throw an error, but still trash the page. This kind of became my litmus test for site reliability.

At this point, I start monitoring the Docker logs coming out of the Wordpress container. I could see the requests I made when I was normally using the site, but every so often, a request I didn’t make would show up – and it was coming from my IP address.

I grabbed my iPad and logged in. Tried deleting a page. No issues. Tried restoring a page. Worked fine. Back to the laptop, trashing or restoring a page throws an error. Bingo. I open up an incognito window and attempt the same process, and it works fine! We’re getting closer. I start enabling extensions one by one: my password manager, Adblock, RES…. they all work fine. Until I get to…

HoverZoom.

This extension, for those that don't know, will pre-fetch an image from a link and display it enlarged when you hover over it. Very useful, but I couldn’t tell you if it worked recently because it became such second nature. So, it prefetches these images by visiting the link and seeing what comes back. Unfortunately for me, it was visiting “links” such as Trash, Delete Permanently, and Deactivate Plugin as I used the Wordpress admin page. And so, I found the cause of my problem.

With a swiftness, I deleted the plugin, and the issue has not reoccurred since.

In other news, for those that were concerned with my yearly website spend, you all can sleep tight at night knowing I’ll be fully removing myself from the Zyro/Hostinger ecosystem. No offense to them, the product is fine, but it’s not a price I want to pay. My current plan is to move to Cloudflare so I can use their load-balancing functionality (with my Sac & Reno servers) for the reasonable price of $5/month (or $120/two-year), and it seems that price stays flat with multiple sites. They’re concerned with endpoints, not domains.

You can view the current self-hosted DJ Lil Nicky site at club.djnicky.net right now. It was quite literally put together this weekend, after the incident. There’s a couple kinks to work out, like a slightly expanded footer on mobile devices, and none of the homepage links work, but it’s called growth.

As for my personal site, I haven’t made any progress, but the skills I’ve learned working with Elementor on the DJ site should be extremely useful. Whether or not I will transfer the blog to my personal site is up in the air currently. I guess it depends how neatly I can tie it all together. Wordpress is a blogging platform, after all.