New to the community? Start here

Corrupt htaccess code being added

One of our website’s is constantly crashing due to an incorrect line of script appearing in the htaccess file.
I contacted my host again and their tech team said that there was a problem with a security plugin. They named WordFence, although I’ve used WordFence for years without any issues.
Could your advanced team take a closer look and try to find out where this line of code is coming from?

Tue, 15 Oct 2019 8:16:56
  • Predrag Dubajic
    • Support

    Hi Scott,

    I had a look at your installation and was able to find the cause of the issue.
    In your wp-content/mu-plugins/ folder you have plugin named endurance-php-edge.php file that has this code which is writing up in your .htaccess file:

    if ( ! defined( 'WPINC' ) ) { die; }

define( 'EPE_VERSION', 0.1 );

if ( ! class_exists( 'Endurance_PHP_Edge' ) ) {
	class Endurance_PHP_Edge {
		function __construct() {
			$this->hooks();
		}

		function hooks() {
			add_filter( 'mod_rewrite_rules', array( $this, 'htaccess_contents' ), 99 );
		}

		function htaccess_contents( $rules ) {
			$handler = get_option( 'epe_php_handler', 'application/x-httpd-php70s' );
			$handler = 'AddHandler ' . $handler . ' .php' . "\n";
			return $handler . $rules;
		}
	}
	$ebc = new Endurance_PHP_Edge;
}

    You can see that the AppHandler that has been causing you issues is mentioned in that code and I found other reports of this plugin doing this, usually after the site has been migrated to another host.
    From what I see this is a part of MOJO Marketplace plugin and you don’t seem to be using on your site anymore so I would suggest removing it completely.
    Note there are other endurance files inside mu-plugins and I would suggest checking if you need that code or not and remove it from your installation if needed.

    There was also some discussion in the chat about Defender and Wordfence compatibility, and while we didn’t had any major reports when running these two together you should keep in mind that these two plugins have similar functionality and when you have two or more plugins doing the same thing it will most likely cause issues and causing more harm than good.

    Best regards,
    Predrag

  • Scott
    • WPMU DEV Initiate

    That’s very strange since I created this website from its inception and have never installed anything from “MOJO Marketplace” that I’m aware of. If it’s a plugin named “Endurance”, I’m certain that I’ve never installed it, not even temporarily. Could it be a plugin with a different name? What else do they sell? I’ve not even seen their website.
    So, how do you recommend I follow through with your suggestion to remove it? Where is it? What is it named? mu-plugins? What are they?
    Please help.

  • Scott
    • WPMU DEV Initiate

    I have to apologize for my knee-jerk reaction. It turns out that this client did have another host before I built his site – Bluehost. Apparently, they load a bunch of pre-configured software, including the Endurance plugin. I did find the files in the folder you mentioned and I removed all 3 Endurance files.
    I also noticed right away that the pages seem to load faster.
    Thank you very much for your help!