What kind of mickey mouse hosting company installs plugins without notifying their customers?

[BrettGregson]

You installed some caching thing on a wordpress site of one of my clients without notifying us. How do I remove it?

[megrimm]

this is a nightmare... i just spend several hours trying to figure out why code changes were not being reflexed in the browser.

cacheing? really? while developing? wtf...

[MikeHansenMe]

Hi @BrettGregson sorry for the delay. If you would like to remove it, you have a few options. On the settings general page you can set the level to 0. On the plugins -> mu-plugins page you can click disable. And after doing either of those two if you would like to remove it entirely you can delete the file mu-plugins/endurance-page-cache.php from your install.

[MikeHansenMe]

@megrimm if you are doing dev on the server it would make sense that caching would get in your way. There are a number of triggers to cause a purge but nothing looks for code changes. There is a purge button on both the plugins->mu-plugins screen and in the admin toolbar (v0.8). I think a better solution may be for us change the cache level to 0 if WP_DEBUG is true. I will try to get that into the next release.

[megrimm]

thanks and apologies for the rant. that day cost me several hours trying to figure out the cause of why pages were not reflecting changes. i basically purged everything I could think of on my local system (thinking that is where the problem originated) only to find this server side caching which, I assume, customers were not informed of. It might not be the cache that is the biggest problem but the lack of communication? but maybe i just missed a memo on this....

[MikeHansenMe]

@megrimm no problem. I understand and you are not wrong in that we can be better about communicating this to customers. Currently the two ways you can get caching are if you have done a new wp install using one of our installers in say the last 6 months or if the site is under a traffic spike and we attempt to cache it as an alternative to it crashing.

[wesbos]

Super bad move - I'll no longer be recommending Bluehost to any of my students

[callummr]

Had a number of sites with bluehost for a few years and the poor performance hasn't been quite enough to persuade me to move, but modifying customers' sites without any comms certainly is. Thanks @BrettGregson for raising the issue so others don't lose so much time.

[ostoh]

I gave up on Bluehost because of such nonsense. Multiple URL injections and cache issues.

[TomClive]

@MikeHansenMe Advice to change the settings for the plugin isn't much help when the htaccess file has been amended and this has prevented access to site and admin area. Nothing was acccesible.

Our affected installation is in a sub-directory and we made custom changes to the htaccess file to help prevent unauthorised access following a hack.

These Bluehost modifications caused unnecessary work reverting htaccess file and deleting plug-in. Although there are only 50 or visitors to the site per day right now, this happened during a critical week for this public-sector project. Not good.

[Johan333g]

DO NOT ACTIVATE THIS PLUGIN delete the file mu-plugins/endurance-page-cache.php from your install using an FTP manager.. Then install a real caching plugin.

@MikeHansenMe "if the site is under a traffic spike and we attempt to cache it as an alternative to it crashing" That is because you have oversold your server space.. use load balancing instead.. don't hack someone's property.

[tmz1970]

HostGator did this too. No warning, no ask.
Also -- this plugin does not seem to respect core Capabilities. I created a custom Role with NO capabilities at all, except to view entries from Gravity Forms. But now these users can also access the Cache top-menu, since this plugin doesn't account for Capabilities.

[Johan333g]

To be a little more specific for those having issue with this.. The federal Computer Fraud and Abuse Act provides in part that Whoever (Mike Hansen, Endurance International Group) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information from any protected computer if the conduct involved an interstate or foreign communication; is subject to a fine under this title or imprisonment for not more than ten years, or both.

If this software was installed without your permission and not removed immediately upon request please file a complaint with the FTC and your local FBI agency.

Hacking is a federal crime with some serious penalties.

Have a nice day

[davidmoore-io]

Yeah.... this just cost us an afternoon. Installing (pretty well hidden) plugins on your clients sites, doing URL injection, editing htaccess files etc etc etc has cost us (and by the looks of things, lots of others) a load of unnecessary work and stress. It appears to be something that the parent company (Endurance) do across their hosting companies?

I'd suggest making it really obvious it exists (why doesn't it conform to the standard WP plugins architecture?), and producing proper docs for devs, would be a wise move.

Bizarre. Cheers for that guys. 👍

[MagneticMule]

Why does anyone use Bluehost in this day and age? I moved away from them long ago. Do yourself a favor and get serious about your hosting. Learn about containers, Linux admin and shift over to somewhere like DigitalOcean. Your wallet and your sanity will thank you in the long run.

[BrettGregson]

@MagneticMule not always the developers choice. One of my clients was using them (I eventually did convince them to move)

[earnjam]

If you don't want to have this caching enabled, you can change it in the WordPress admin under Bluehost > Performance (if you have the Bluehost plugin active), or under Settings in the Endurance Cache section by choosing Off (Level 0) from the select input.

Once disabled, you can remove the mu-plugin, or just leave it, as it does nothing at that point.

If you are still having problems, please feel free to add a comment or open a new issue. We're working on some major improvements to the plugin and we'd love to get any issues resolved. As noted above, we'll do better about communication if these types of changes are ever implemented in the future.