Update #9 Lessons learnt after WordPress update

by arjan Wordpress

I don’t check my blog every day (and I think you don’t either). Just today I gave my URL to a colleague and more or less by mistake I clicked the link. And so I found out that my site was showing without any CSS and therefore being completely dis-functional. Also the admin pages did not work! Mild panic…

It has taken a few hours to figure out what happened and finally how to fix it: On May 24th an automatic WordPress update was installed. First I thought this had broken my WordPress theme. But even after hacking the database to change the theme to the default theme, the problem was still there.

After some more frustrated trial and error and a lot of googling, I finally had my “Aha Erlebnis” (https://en.wiktionary.org/wiki/Aha-Erlebnis). The new WordPress update had overwritten the wp-settings.php file. This file requires an extra line for my site to work with https. How I figured this out when I started with WordPress, is another story full of frustrations. Anyway, adding the following line to wp-settings.php solved my problems:

if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS']='on';

Now, is there a learning and can I avoid this problem in the future? Well, that is a YES and a NO at the same time.

Maybe you’d say: didn’t you have a working backup? Yes, I have a perfectly working daily backup, automatically created by Proxmox. This is a backup for the complete LXC container (a.k.a the virtual machine) that runs WordPress + MySQL. But… when you have the WordPress automatic update feature enabled, this does not help at all. After the backup restore was completed (takes only a minute or so), my site worked perfectly well… for 10 seconds. After 10 seconds, the WordPress auto update kicked in again and the new version of WordPress was enabled. So the blog was broken once more.

So my first learning: although with pain in my heart because it is less secure, I have to disable the automatic update. Turns out it is not obvious how to do this. Cannot be done in the admin gui, but you have to add a line to wp-config.php:

define( 'WP_AUTO_UPDATE_CORE', false );

This measure avoids breaking my blog without me being “at the buttons”. And it also avoids that I cannot fix a problem by restoring a backup. It is not the perfect solution though, as I still will have to add the mentioned line to wp-setting.php after every major update. But if I initiate the update by hand, then I will immediately see the problem and fix it within a few minutes. That is acceptable for me.