My site has been blacklisted please fix!

[nole99]

My site http://www.justkeepblogging.com has been blacklisted but there is nothing malicious on the site.. Its has been cleared by all other

Please help!

Joanna

[Hayton]

Looking into it. Any particular reason why you're with Incapsula? The way they handle things makes it difficult to isolate any server-related problems.

[nole99]

I didn't realize I had that....I had to look it up. I just downloaded wordpress Better WP security did it come with that maybe?

[Hayton]

nole99 wrote:
I didn't realize I had that....I had to look it up. I just downloaded wordpress Better WP security did it come with that maybe?

Very likely. While I approve of anything that makes a WordPress site less open to attack - and WordPress and Joomla sites are a favourite target of hackers - it makes the job of identifying what's being flagged on your site particularly difficult. I was unsure why your site appeared to have not just two IP addresses but at least three locations - the server is variously reported as being in the eastern US, mid-west US, and Singapore, and traffic appears to be routed through Japan and Israel. Half my diagnostic tools are mis-reporting site information.

I went to the home page for this plugin and the reasons for this mis-reporting are now clear.

http://wordpress.org/plugins/better-wp-security/

Better WP Security will hide the places those vulnerabilities live keeping an attacker from learning too much about your site
After we hide sensitive areas of the sites we'll protect it by blocking users that shouldn't be there
Ban troublesome bots and other hosts
Ban troublesome user agents
Strengthen server security
Better WP Security will still monitor your site and report attempts to scan it (automatically blocking suspicious users)
Detect bots and other attempts to search for vulnerabilities

So my attempts to scan your site will have been noted

... which is, of course, good. It shows the security plugin is working.

Although I don't know whether making repeated attempts to scan the site means that somewhere I'm now being blocked. Maybe.

One last thing (for now) : I'm seeing different results for the two versions of your site address -

"http://www.justkeepblogging.com"

"http://justkeepblogging.com"

The two are clearly connected because they both appear together on the network graphs, but the traffic for each is very different.

Message was edited by: Hayton on 04/10/13 21:07:27 IST

[Hayton]

.... and I hope you read the reviews and are aware of what this plugin can do if (or when) something goes wrong

http://wordpress.org/support/view/plugin-reviews/better-wp-security?filter=1

As for Incapsula : no, I don't think the Better WP Security automatically signs you up to Incapsula, but if you're with them you probably need another WordPress plugin - http://wordpress.org/plugins/incapsula/

By using this plugin you will have no change to your originating IPs when using Incapsula. Incapsula acts as a reverse proxy and all incoming connections to your website first pass through one of Incapsula's servers. This plugin will ensure that you continue to see the real originating IP of your website visitors.
Through a simple DNS settings change, website traffic is seamlessly routed through Incapsula's global network of high-powered servers. Incoming traffic is intelligently profiled, in real-time, blocking even the latest web threats

It's not something I think you could have signed up to without realising it. The security you've got in place is suitable for a high-traffic blog containing contentious material likely to provoke cyber attacks from outraged trolls and script kiddies. Only you know whether all that is justified ...

Message was edited by: Hayton on 04/10/13 21:22:53 IST

[nole99]

Thanks for the information although the site has been blacklisted for a week now and I just downloaded the wp security yesturday.  I wasn't sure if you were thinking the two had something in common.  I did fill out that review my site form but havn't heard back.  Is that what I'm waiting on in order for them to remove the red threat?

If so, how long does this take??

I also have site lock and they ran a full scan of everthing and found nothing so I'd love it if Mcafee would put me back on the good list!

Thanks!

Joanna

[Hayton]

So the blacklisting is not because TrustedSource was detecting anything unusual with the IP address or location. That tells me something, at least. There are some other aspects that need investigating, but I'll probably need to run a few other tests now (or probably a bit later).

Request A Review starts a process which can take a number of days to complete. Meantime TrustedSource is flagging you for an unknown reason. I'll see if I can narrow down the field a little, that's all I can promise.

[nole99]

ok thanks!  I appreciate it

[nole99]

One last thing (for now) : I'm seeing different results for the two versions of your site address -
"http://www.justkeepblogging.com"
"http://justkeepblogging.com"
The two are clearly connected because they both appear together on the network graphs, but the traffic for each is very different.
Message was edited by: Hayton on 04/10/13 21:07:27 IST

ok so here is where I think the problem is.  I originally had the site justkeepblogging.com masking my affiliate site for empower network.  Then- I decided to start my own WP thesis site and I redirected the domain name to that site.  I just found out that all of my google anaytics etc..are still connected to the old site.  How do I seperate the two?  This may be why site advisor is flagging it although my empower network site shows up green and safe...This is also why the traffic is very different. 

Joanna

[Hayton]

nole99 wrote:
ok so here is where I think the problem is.  I originally had the site justkeepblogging.com masking my affiliate site for empower network.  Then- I decided to start my own WP thesis site and I redirected the domain name to that site.  I just found out that all of my google anaytics etc..are still connected to the old site.  How do I seperate the two?  This may be why site advisor is flagging it although my empower network site shows up green and safe...This is also why the traffic is very different. 

No, that's not the problem. At least, I don't think so. I can see several possibilities, but the relationship between the sites is clear enough from the flow of HTTP transactions.

.

And here are the traffic graphs which I found so problematical.

1 : http://justkeepblogging.com

2 : http://www,justkeepblogging.com

But none of that is any reason for TrustedSource to distrust your site. No, the answer is within the site structure and the site code. I'm almost there, I think. I just need to close down about twenty tabs to get rid of all the false leads, and then I should have it.