Wordpress Deleted A page - Help?

So, I have an audit log for one of my clients as they frequently say we did stuff that we didn't and in the audit log (logs everything that happens) I saw that a page was deleted by wordpress (screen shot link below). I have never heard of this happening before nor do I know why it happened. I verified that the page was gone and I needed to remake the page. It was a thank you page so easy enough to fix, but it could happen again to a more meaningful page.

To my understanding since its registering a "system" its not a user. If it was a user, it would say user. Any insight into preventing it from happening again? I use the same plugins on another site of mine and everything works fine, no randomly deleted pages.

http://prntscr.com/alkojq

Thanks for any help,
Brett

  • Predrag Dubajic

    Hey Brett,

    Hope you're doing well today :slight_smile:

    This certainly sounds strange and if the plugin is saying that system removed that page it's most likely triggered by some function on your site.

    Have you tried checking for any scheduled cron jobs that could done this?

    These plugins should help you with that:
    https://wordpress.org/plugins/wp-crontrol/
    https://wordpress.org/plugins/advanced-cron-manager/

    Let us know if this gives any result.

    Best regards,
    Predrag

  • Adam Czajczyk

    Hello Brett,

    I hope you're well today and thanks for your replay!

    The screenshot that you attached suggests two actions that possibly could delete posts: "wp_scheduled_delete()" and "wp_scheduled_auto_draft_delete()". However by default none of them should automatically remove any "live" post/page.

    The first one is meant to automatically clean WP trash. According to WP Codex it

    Permanently deletes posts, pages, attachments, and comments which have been in the trash for EMPTY_TRASH_DAYS.

    The latter should clean auto drafts (automatically created "drafts").

    Unless some other plugin is interfering here this shouldn't affect any published posts/pages and I must admit I've never came across such issue before as well. I didn't find any references to these two actions "auto deleting" content either.

    We can however try to investigate it further. Please add following code your current theme's "funcitions.php" file:

    function print_filters_for( $hook = '' ) {
        global $wp_filter;
        if( empty( $hook ) || !isset( $wp_filter[$hook] ) )
            return;
    
        print '<pre>';
        print_r( $wp_filter[$hook] );
        print '</pre>';
    }
    print_filters_for( 'delete_post' );

    Once this is done, please visit first site's dashboard and second site's front-end. The code should produce some output on both back- and front-end which may or may not be the same. Please share it with me here. Once you copy that output from your site you may immediately remove the code from "functions.php" file.

    Best regards,
    Adam

  • Mark A. Mapp

    Sounds good. I did as you said, and here are the results. Hope it helps.
    Dashboard code

    Array
    (
        [10] => Array
            (
                [_wp_delete_post_menu_item] => Array
                    (
                        [function] => _wp_delete_post_menu_item
                        [accepted_args] => 1
                    )
    
                [delete_get_calendar_cache] => Array
                    (
                        [function] => delete_get_calendar_cache
                        [accepted_args] => 1
                    )
    
                [000000000d5a48cb00007fd2a0800045purge_varnish_cache] => Array
                    (
                        [function] => Array
                            (
                                [0] => WpeCommon Object
                                    (
                                        [is_widget] =>
                                        [already_emitted_powered_by:WpeCommon:private] =>
                                        [options:protected] =>
                                    )
    
                                [1] => purge_varnish_cache
                            )
    
                        [accepted_args] => 1
                    )
    
                [000000000d5a495700007fd2a0800045clear_cache] => Array
                    (
                        [function] => Array
                            (
                                [0] => Yoast_Dashboard_Widget Object
                                    (
                                        [statistics:protected] => WPSEO_Statistics Object
                                            (
                                            )
    
                                    )
    
                                [1] => clear_cache
                            )
    
                        [accepted_args] => 1
                    )
    
            )
    
    )

    Front end

    Array
    (
        [10] => Array
            (
                [_wp_delete_post_menu_item] => Array
                    (
                        [function] => _wp_delete_post_menu_item
                        [accepted_args] => 1
                    )
    
                [delete_get_calendar_cache] => Array
                    (
                        [function] => delete_get_calendar_cache
                        [accepted_args] => 1
                    )
    
                [000000001d65322b00007fd2837ba9f0purge_varnish_cache] => Array
                    (
                        [function] => Array
                            (
                                [0] => WpeCommon Object
                                    (
                                        [is_widget] =>
                                        [already_emitted_powered_by:WpeCommon:private] =>
                                        [options:protected] =>
                                    )
    
                                [1] => purge_varnish_cache
                            )
    
                        [accepted_args] => 1
                    )
    
            )
    
    )
  • Adam Czajczyk

    Hello Brett,

    Thanks for getting back to me with this!

    I hoped it would help but I admit there's nothing that would seem significant. The code was meant to give us at least a clue of what could possibly be calling "delete_post" action and it looks like the Varnish Cache plugin and some calendar plugin are the only ones here. However, Varnish Cache operates on a server side and would not delete posts and the calendar plugin seem to be operating only on its own cache (which, I suppose, relates to a custom post type anyway).

    There's another issue that bothers me here a bit. On the screenshot that you attached to your initial post here there's a "weird" user named "WP System" (you already mentioned it). This would mean that the action was performed not from any real user account but rather independently - e.g. on server level. That gets me to thinking that the possible explanation here may be either malfunctioning Varnish Cache or some sort of backup is periodically restored (automatically or manually by host staff) using backup archives old enough to not contain that missing posts.

    Do you think that'd probable? I suppose it may be worth double-checking with hosting provider.

    Best regards,
    Adam

  • Mark A. Mapp

    The hosting im with is actually troubleshooting in parallel and looking to see if it is a plugin / theme issue in any way. That's more of a long term thing as they are waiting and checking back on a copy of the site that they made.

    I did double check backing up and there was no restore done. This site is not without its problems, and I would not be surprised if the problem is malfunctioning Varnish Cache. It was programmed before I started. We are currently working on a re-design of the site, in the very early stages. Is it safe to say, the cause of this probably will not be resolved, and best to move forward with the new design as soon as possible.

    Let me know your thoughts.

  • Adam Czajczyk

    Hello Brett!

    The hosting im with is actually troubleshooting in parallel and looking to see if it is a plugin / theme issue in any way. That's more of a long term thing as they are waiting and checking back on a copy of the site that they made.

    That's good to know that they're working on this either. Actually, I do think that their help on this may be indeed invaluable. Especially, given the fact that they do have access the most "core" server logs.

    I did double check backing up and there was no restore done.

    At least that can be eliminated :slight_smile:

    This site is not without its problems, and I would not be surprised if the problem is malfunctioning Varnish Cache

    I definitely wouldn't be surprised as well though I admit I'm not 100% sure. So far though, that'd be my best bet here. I never came across such an issue and even after some extensive research around the web I couldn't find any reasonable explanations why such thing could happen. I think the most promising action now would be to go on with redesign and wait for replay from host. Hopefully they'll be able to shed some light on this or at least their response will point us in a right direction.

    Best regards,
    Adam

  • Adam Czajczyk

    Hey Brett!

    I'm really sorry I wasn't of more help on this one. The issue is extremely uncommon and difficult to diagnose without full access to that site it's happening on and some more observation. However, in case a replay you'll get from your host suggested that the main culprit here is a plugin or anything else WordPress related - let me know please and I'll be happy to continue working with you on this.

    Have a nice day!
    Adam

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.