I have refreshed the dev site with a fresh copy of the live site.

I will be using this to test updating from WP 4.9.16 to 5.5.3

The backend server will soon be forced to update to PHP 7.4 from 5.6

I have found a workaround that will let me set the PHP for this site back to 5.6 but we will still need to get the plugins up to Php 7 standards at some point soon.

Here is how things stand.

Even though I am the only active admin now I have decided to let Op and Shark retain full admin privileges incase they want or need to do something on the site. The door is always open if you guys want to work on something.

Change of host
Over the past few months iv been increasingly dissatisfied with the hosting provider I was using for the site and have since moved the entire site to a new hosting provider. So far this has resulted in a marked improvement in both site stability and overall site security

O the hax
I have spent much time blocking IP address that have appeared on the servers logs. 80% of the attacks are from China with 10% from the Ukraine and the rest out of Europe or the US. On average the site gets hit with about 200+ attempts to gain access to the sql database or wordpress cron job function per day.

Load off the mind
With these additions, changes, and sometimes reworking of the htaccess file I have noticed a positive drop (total stopping of) security related email alerts.

Where the $ meets the road
With the change in hosting providers I have also been able to save about $40 - $60 off the slot cost. This savings will be reflected in the running costs of 2017.

What the Dev?
The dev site has also been moved and re-imaged off the latest live build.
The new dev address is dev.dg2freemaps.com

NOTE:
Right now its blocked to the outside but if you reply with your IPV4 address I can add you to the white list so you can gain access.

Backend stuff
We now have cron jobs that are running on the site through the server (not wp) that are optimizing and backing up the sql db every day. This will help keep the site and db running smoothly and will result in less site downtime for maintenance.

On the road again
The roadmap / Phases I outlined before are still in play. Im going to try to chip away at them as I learn and test things. If anyone feels like helping let me know, would love to work as a team on some of this as I know im out of my depths on a fair bit of the PHP side.

Thats about it, let me know if you have any questions.

Happy Core Defending Team

Normally most of the attacks we see dont come close in guessing the master admin name or password but today that was different.

Somehow a bot or person got ahold of the master admin account username and tried to log in. The security already in place bounced them out but I took immediate action and scrambled the master admin username. I have also added a new security plug-in to work along side of the security we already have in place.

This latest IP traced to China, but in the long run that means nothing.

I think they got the master admin by exploiting a wp function also called a /?author=1 attack.
I have also made an addition to the .htaccess page to stop this from happening again.

A this point we are in monitor mode. If they try again with the new scrambled admin username we will know at lest the leak didnt come from what I just fixed.

Time will tell. Keep an eye out.

I am trying to hunt down a plugin conflict issue and require the dev site to have the latest image of the live.

Therefor I am processing the reimage now. I will backup all the old dev data but this will mean that any updates or work in process on the dev site will be reset.

Ok, iv started posting issues and code update projects here so we can collaborate and get a few of them done.

Please look out for anything titled "Open Task"

This will indicate what needs to be tackled at present.

Please do what you can and thank you in advance for your help.