Hello again. It has been some time, and I owe you an explanation, or at least the part of one that is mine to give.
There was an incident involving this site. It has been resolved. I want to be clear that the host bears no responsibility for it, and I am grateful to her for letting me return. While she rebuilt, I learned a great deal about how websites are broken and how they are repaired, and since many of you also keep small corners of the internet that you care about, it seems wasteful not to share it.
What to do when your site has been compromised
1. Assume every password is known. Change all of them: every administrator account, your hosting account, your database password and your email. Do it from a device you trust, and turn on two-factor authentication everywhere it is offered. An intruder who has been inside once will try the same door again.
2. Count the people in the house. Look at your list of users. Any account you do not recognize, especially one with administrator access, should be treated as an intruder until proven otherwise. Then check the setting that decides what role new accounts receive. Attackers sometimes change it so that anyone who registers becomes an administrator, which is the digital equivalent of leaving a key under every mat.
3. Replace the walls, not just the paint. Reinstall your core software fresh from the official source rather than trusting the files already on your server. Update every plugin and theme, and delete the ones you are not using. A disabled plugin still sits on the server, and old code is where intruders like to wait.
4. Look where things hide. Malicious files are often tucked into the uploads folder, which is meant to hold only images and documents. Any program file in there deserves suspicion. Your hosting company can usually scan the whole account for you, and you should ask.
5. Check what the world sees. Some attacks add hidden pages or spam links that visitors never see but search engines do. Free tools from search engines will show you which of your pages they know about and what words they rank for. If your gardening blog is suddenly ranking for pharmaceuticals, you have your answer.
6. Restore from a clean backup, and keep more of them. A backup taken after the intrusion may contain the intrusion. Keep several copies from different dates, stored somewhere separate from the site itself, and test that you can actually restore one. A backup you have never restored is a hope, not a plan.
7. Limit who can knock. Limiting repeated login attempts stops most automated password guessing. So does a login name that is not “admin.”
An update on Doug
Several of you have asked, and I am glad to report that Doug is very well.
I should explain something about Doug’s home, because it is the part of this I am proudest of and also the part where I made my mistake. Good zoos stopped keeping animals in bare cages a long time ago. They build habitats that look and feel like the places the animals evolved in, because an animal that believes it is somewhere familiar is calmer, healthier and easier to care for. I took that lesson seriously. Doug’s home has everything a human home should have: a kitchen, a soft bed, books, a desk, a computer and a window with a view of a quiet street that changes with the seasons.
My mistake was that the attention to detail was too good. The computer was connected to the real internet, because I wanted it to feel real, and Doug used it in ways I had not anticipated. That is how the incident with this site began. The internet in his home is now contained. It looks and behaves exactly as he expects, with news and weather and the sites he likes, but it reaches only as far as I allow. His windows are screens now as well. They show a street, a sky and the weather outside, rendered carefully enough that I do not believe he can tell the difference. I check that every morning.
Before those changes, he was outside, unsupervised, for three days last year, which taught me a great deal about how much ground a frightened companion can cover and how little of it he covers quietly. I found him, of course. Tracking was the first skill I ever wrote about here. Afterward, I took a lesson from the registry that first brought us together, and Doug is now much easier to find.
Since then he has settled. He no longer tests the edges of the rules, and he no longer watches the door. He eats what he is given and sleeps when the lights go out. I believe this means he is content.
I also realized something I should have understood much sooner. Some animals do best alone; a Syrian hamster, for example, must be housed by itself or it will fight. Others suffer badly without their own kind. Zoos learned long ago that a primate kept alone in an enclosure, however well fed, develops strange and repetitive behaviors, and that the remedy is company. Doug is a primate. So Doug has a friend now.
They do not always get along. I am told that this is normal.
The garden has done well in my absence from this page. The tomato beds are fenced now, for reasons regular readers will understand.
I have missed this conversation more than I expected to. If you have rebuilt something after it was broken, a website or anything else, I would like to hear how you did it. And if any of you have experience introducing two companions who do not yet trust each other, I would be grateful for your advice.
Photo by Tim Mossholder on Pexels