Admin not showing all the snapshot.

I can see all the 7 back-ups according to my setting from FTP (http://take.ms/5wQim) but they are not showing in the admin list. Only one is showing. Please help.

  • Ivan

    Hi Chris !

    First of all, if you want to update the admin snapshot list you can open WP Dashboard -> Snapshot -> Import and run Import. But it doesn't help in your case because it looks like all of these backups were created at the same time GMT: Saturday, October 17, 2015 10:19:13 PM (actually I guess they are just the same backup with some custom modifications :expressionless: ) If you really want to see a lot of the same old backups on the list - you can open each of these ZIP-files, find snapshot_manifest.txt file there, change this time there and save this change.

    Best,
    Ivan.

  • Chris

    Ivan
    First thing. I was receiving Wordfence urgent messages that there were multiple Admin logins using my Admin username from various countries, Bangladesh, Laval Canada and Ukraine.
    So, I opened a chat with Nithin and asked the questions, are these your team logging in or is my site being compromised? Does Wordfence see when your team accesses my site through Support Access in Hub, as an Admin login? He could not definitively answer and thought it might be you in Ukraine but the Laval log in he was not sure on. He tried to reach out to you for clarification but was not able to. So, his suggestion was to create an Admin user for your team, provide him the login and password and then change my password on my ChrisK user. While in my backend I noticed an admin user was created wpmutest or some such, so I logged that user out and deleted it.

    I did all of this within half an hour to 1 hour of the first login from Ukraine.

    I then woke up to another message that somebody had created a new admin user from outside of Wordpress.

    ------------
    Critical Problems:

    * An admin user with the username wpmutest23 was created outside of WordPress.
    -------------

    So, being very concerned that this site had been compromised, and not getting the information from Within that I needed to feel secure, I would like to know if the following logins are your team, or whatnot.

    This email was sent from your website "OhSo Cresteds" by the Wordfence plugin at Saturday 7th of April 2018 at 12:49:44 AM
    The Wordfence administrative URL for this site is: https://ohsocresteds.com/wp-admin/admin.php?page=Wordfence
    A user with username "wpmutest23" who has administrator access signed in to your WordPress site.
    User IP: 37.229.162.5
    User hostname: 37-229-162-5.broadband.kyivstar.net
    User location: Kharkiv, Ukraine

    This email was sent from your website "OhSo Cresteds" by the Wordfence plugin at Saturday 7th of April 2018 at 12:42:37 AM
    The Wordfence administrative URL for this site is: https://ohsocresteds.com/wp-admin/admin.php?page=Wordfence
    A user with IP address 37.229.162.5 has been locked out from signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 3. The last username they tried to sign in with was: 'ChrisK'
    User IP: 37.229.162.5
    User hostname: 37-229-162-5.broadband.kyivstar.net
    User location: Kharkiv, Ukraine

    This email was sent from your website "OhSo Cresteds" by the Wordfence plugin at Friday 6th of April 2018 at 10:04:05 PM
    The Wordfence administrative URL for this site is: https://ohsocresteds.com/wp-admin/admin.php?page=Wordfence
    A user with username "ChrisK" who has administrator access signed in to your WordPress site.
    User IP: 37.229.162.5
    User hostname: 37-229-162-5.broadband.kyivstar.net
    User location: Kharkiv, Ukraine

    This email was sent from your website "OhSo Cresteds" by the Wordfence plugin at Wednesday 4th of April 2018 at 10:19:18 AM
    The Wordfence administrative URL for this site is: https://ohsocresteds.com/wp-admin/admin.php?page=Wordfence
    A user with username "ChrisK" who has administrator access signed in to your WordPress site.
    User IP: 216.244.82.20
    User hostname: 216.244.82.20
    User location: Laval, Canada

    This email was sent from your website "OhSo Cresteds" by the Wordfence plugin at Tuesday 3rd of April 2018 at 10:32:06 PM
    The Wordfence administrative URL for this site is: https://ohsocresteds.com/wp-admin/admin.php?page=Wordfence
    A user with username "ChrisK" who has administrator access signed in to your WordPress site.
    User IP: 119.30.38.27
    User hostname: 119.30.38.27
    User location: Dhaka, Bangladesh

    Also, would like to know if Wordfence sees and reports your support access logins from Hub?

    If you could confirm the above logins were ALL from your team, that would help me relax about worrying that my site has been compromised!

    As far as Snapshot goes. I have no idea what is happening with those snaps. I have been running snapshot on that site since 2014, daily automated snaps, save 7 days. Other than being sure to keep snapshot up to date, I have never had to actually use it on this site, until last week when I thought I needed to roll back post theme update. As it turned out I did not need to, the issue was resolved with a theme setting.

    So? What is going on with Snapshot on this site? Is it working correctly? Is there anything I need to do?

    Thanks Chris

  • Ivan

    Hi Chris !

    It seems you didn't read my previous reply here where I mentioned about the issue with Wordfence and new wpmutest23 account.

    Also, would like to know if Wordfence sees and reports your support access logins from Hub?

    I think so, but I didn't use our support access, I use WP credentials which you provided our team.

    If you could confirm the above logins were ALL from your team, that would help me relax about worrying that my site has been compromised!

    I told with Nithin yesterday and as far as I concerned, he told you that all of those logins were from our team except the Canadian one.

    So? What is going on with Snapshot on this site? Is it working correctly?

    You can create a new Snapshot. If after that you can see it in the Snapshot list - it means that everything works correctly. However, as I mentioned it above, I don't recommend you use that very old Snapshots.

    Best,
    Ivan.