Hi all-- I checked my site snowlion.org which is hosted at ipage and found a bunch of code that I did not upload. I deleted it and it came back. Now when I load the site in the browser and use Safari developer to see the page source-- the extra script is visible in the header and before closing tag, but it’s really short-- just a few lines. When I go into my files on the file manager at ipage- this script goes on for hundreds of lines–really dense and long-- in both the header and just before closing tags. I called tech support on Ipage and asked where this extraneous crap came from–was it something they’re doing- and they told me it was a security liability with the blocs app I used and that I needed to add siteloc which would scan and automatically remove stuff like this because the malware would affect visitors. The site looks just fine to me from other devices and browsers. I don’t believe them because my other site snowlionmalamutes.com was hand coded years ago with no apps (it’s not mobile friendly and I haven’t upgraded it in years) and it too has the same extra script showing up (just this past month and not in the previous years I’ve had this site)… It takes me 5 minutes to scroll down page after page to remove it and to find the actual body section where I wanted to make some text changes. Anyway, Ipage tech support told me I need to pay $30 a month for each site I have with them to install siteloc. That’s 90$ a month extra beyond their regular service fees. They insist a weakness in the Bloc code I uploaded is allowing some malware/bot on my site. I told them I’d never had a problem before and was considering just cancelling my service with them. They responded that I wouldn’t get any of the annual fees back (just paid the renewal last week) and that if I went to any other hosting service I would have the same problem unless I paid for siteloc or additional security because it’s a vulnerability in the app/code I used. This sounds like a lot of BS to me, but I am hoping someone with more knowledge about security issues, site loc and using Blocs app could advise me, or recommend another hosting service that is more secure. Sorry for the long post-- I just wanted some advice.Blocs has been wonderful to work with. Thank you in advance.
Interesting injection situation.
Do you see this in your page source when viewed locally in a browser or only once you upload the exported files to the server? Does it appear in the exported files locally before uploading or only instantly after uploading to ipage?
Blocs app does not add this. What did they say was the specific “security liability” ? Have them tell you specifically what is present that allows this to be caused.
What is the specific weakness ? Have them tell you specifically what is present that allows this to be caused.
Ask them to tell you specifically what is the exact vulnerability that is present with the site(s) that allows this to be caused since your other site also has it that was not built with Blocs.
I know nothing about ipage, but I would have to agree concerning the BS. I looked at your source code and found the following on your index pages of both sites. Was it also appearing on other pages of just the index pages of these sites?
These are the two instances on those pages, minus all the code, indicated below as […]
<!-- start of StopAd injection -->
<script nonce="">
/* domain=www1.ipage.com */
(function() { [...]
</script>
<style nonce="">
/* domain=www1.ipage.com&generic=1 */
[...]
</style>
<!-- end of StopAd injection -->
</head>
<!-- start of StopAd injection -->
<script nonce="">
!function(t)
[...]
</script>
<!-- end of StopAd injection -->
</body>
I’m not familiar with it but do you happen to use StopAd on your machine or as browser extensions? If so and regardless, do you see this in the source when viewed locally in a browser via Blocs preview, or only once you upload the exported files to the server? Does it appear in the exported files locally before uploading or only instantly after uploading to ipage?
This sequence of checking the page source and when it occurs would make for a nice screen recoding video to demonstrate when it occurs.
Do you have other sites hosted with ipage that this also occurs on?
Hi- Thanks for the quick response. I will call ipage tech support and ask them for specifics.
I haven’t checked every page (there are 14+), but the couple of pages that I did on both the site made with blocs and the hand-coded very old one, all had the same repeated script. It also appears on the site I made with blocs for my husband-- truckeeplumbingservices.com (again, the script was most definitely not there in summer when I finished the site and uploaded it. The script also appears over and over on a very old site that was made with iWeb several years ago. I just hadn’t deleted the folders and it’s been offline since last spring.
I opened some of the bloc files stored locally on my desktop with my browser and then with page source-- no stopad code appears. I checked some of the backup ‘old site’ files on my computer- same thing-- no stopad code appears. I uploaded a new page (blocs file) that was free of the script to the ipage server and the script appeared instantly. I don’t have any StopAd extension on my browsers. (I checked both Safari, Chrome, Opera.)
I am curious what they will tell you.
Since in your own described test case you have already proven its not specifically related too Blocs and instead seems related to their hosting based upon the various non-Blocs sites it also appears upon.
Clearly it is not a blocs issued despite what the first tech support claimed, I am so sorry to have troubled you with it. They have not given me specifics on why this is happening only that they escalated the case. This morning I received an email from tech support saying my index files had malware and that I should upload a ‘clean’ file, which thanks to your suggestion, I already did and the problem reappeared. When I called again today, they admitted that the problem appears to be at their end and not with the apps I used to build the site. They are working on it and agreed to remove the problem without requiring me to pay for site loc. Cheers.
No trouble at all @jc99, I am glad its getting resolved for you by them.
Good to know, keep us posted what comes of it.
PS: Those dog and Alaska photos are majestic. ;–)