Randy Calvert

So... let's pause here for a moment to consider a few things: This does not appear to be an IPS problem. It appears to be the problem of a specific 3rd party resource provider. This does not appear to be impacting a large swath of IPS customers, so this would seem to suggest this was not an exploit in the IPS software itself. The domain does NOT appear to be hosted by IPS cloud. It's pointed to Hivelocity. If the domain is supposed to be hosted by IPS, that means the DNS for the domain was hijacked. (Not an IPS issue.) The domain is not using IPS' name servers... they're using the default Namecheap registrar name servers. (This leads me to believe the site is self-hosted) If the domain is supposed to be self-hosted, it looks like the self-hosted web hosting account or their server/VPS, is hijacked or that the compromise happened by some other means (either weak 3rd party resources, other non-IPS software running on the site, etc.) No one except the site owner (the 3rd party resource author) can say exactly what happened with their site and if any data was compromised. By default, things like credit card and password information is encrypted by the IPB software. You might want to reach out to that provider directly for assistance as IPS itself cannot do anything in this case.

It's not how many logons would eliminate the cron, but instead do you have traffic happening basically 24/7. For example, if you have no users from midnight to 5 am, none of the tasks that run in that time would run without cron or something else to execute those tasks. In addition, even if you were able to run it with traffic... if it's a 500 error, it would still fail to run. Again, you need to look at the server logs to figure out why the task triggers a 500 error. That will happen regardless if it's triggered via cron or running with traffic. And v5 will be like v4 in terms running background activities. Cron is highly recommended as it's the most reliable method in case you don't have traffic during certain times. If you don't know how to get or understand your server logs, you might want to use a third party resource to help. https://invisioncommunity.com/third-party/providers-directory/

Commerce has not been removed. It will continue to be available and they're adding more support for digital transactions (like better ad support, more subscriptions options, selling different digital offerings on your site, etc). The only thing removed from Commerce is the ability to ship physical products. The marketplace closure is not related to IPB5 development and has been done for MONTHS already.

yourdomain.com/admin/?app=core&module=membersettings&controller=notifications Click on profiles. There are settings there to disable notifying users in the notification list and via email. You would want to make sure emails are not enabled by default. That will change all new members to not receive emails. Regarding changing everyone else's settings to not receive emails... you would have to reset their full notification settings. See that Reset All Members to Default Preferences button? It will reset ALL members for all notification types to whatever you've got currently set for the various notification types. There is no way to reset all members preferences ONLY for profile settings. It's going to reset ALL notification settings for ALL users. So make sure you understand the implications of that. If users have selected to not receive certain notifications in say clubs or another area but your default enables it, this will change everyone back to what you have as the default.

I think you may be thinking of this post: Either way, IPS's bounce management process now will automatically control your bounce rate by disabling emails to users that are bouncing email. That in essence is cleaning your list over time as emails are sent. 🙂

Email providers are not looking at you specifically. They are looking at the sender (AWS in this case). If they don’t like them, they block AWS IP addresses. They are not blocking at the domain level with large providers because it’s too easy to switch to sending spam from a different hostname.

If emails bounce, in cloud IPB will automatically disable email to that member and will show an icon to that user to let them know they need to update their email address. As a result, you should not need to worry about a percent overall. IPS takes care of this for you as part of managing their rate with AWS.

Each plugin author can have their own website. Many of them list their resources (but are not required to) on the third party website invisionify.com.

If you are not comfortable doing the upgrade, you might want to reach out to a third party resource who offers these sorts of services. https://invisioncommunity.com/third-party/providers-directory/?advanced_search_submitted=1&content_field_231[4]=4&content_field_232[0]=0&content_field_232[1]=1

Does this happen when using a new default unmodified theme?

It sounds like your theme is out of date. Login to your ACP (domain.com/admin) and create a NEW theme and make it your default. See if that solves your problem. If so the problem is with your existing theme not being compatible with the latest version.

Yes, it removes PMs, profiles, posts, gallery content, files, etc. It’s like they never existed.

If that content was set to 7 days, you can’t retro change it to one day. It would take effect for new deletions.

They used to do this. However this prevents them from doing some cool things with the software to make it more seamless and powerful. IPS is moving in a direction of wanting to create powerful features that literally tie everything together. That becomes almost impossible when you have to build tons of logic around if you have this module but not that module or you only have 3 of the 4 modules, etc. Affordable is a relative term. The initial cost is $499 for the first year. That's literally $1.37 per day. Subsequent years are $199 a year. That means it's $0.55 per day after the first year. Would you work for less than what you feel you are worth? IPS assigns a value to their products that allows them to pay a LOT of people that are continually adding new features and capabilities. Just because the price may not match what you want to pay does not mean it's not fair or affordable. Would you go up to a Ferrari dealership and tell them they should sell you a Portofino for the cost of a Prius because you don't like the price?

This is not a port/protocol issue. IPS is a website... so it would use TCP 80/443. If this was a basic issue like that, you would not even be connecting to the site whatsoever. If you put a WAF in place, you're going to have literally hundreds of rules. These all vary from WAF vendor to WAF vendor. There is not a central "WAF rule database" to say you should specifically override and allow rule 990294 and 100111. This is basically you decided to hire a security guard to sit in front of your website. The website (IPS) is not aware of that guard. Who they allow in depends on what you tell them to. Sometimes out of the box rules don't behave the way you expect them to... this is called a false positive. You would have to either look in your WAF rules to see what is triggering and create an exception, or turn it off. But again, IPS does not even use your WAF to know what rules it has, how it is configured, or what needs to be allowed.

And for the love of everything good in the world… start keeping backups. You’re literally playing with fire by not having good/recent backups. If your website is ANYWHERE near important to you, this should be a priority for you.

It’s not available yet. It’s still in alpha testing. 4.7.17 is the latest version currently available.

I would look if you have something like CSF or mod_security installed. As this is a server configuration issue, IPS can’t help/advise on how your server is configured.

There has not been any changes to video embedding so far in v5. That does not mean it won't ever change, but it's not going to happen most likely soon.

I’m not sure you want IPS to do here. This is a third party resource. They’re not going to change the core software for something developed by someone else. I get you’re wanting to improve SEO, but this is not an IPS problem to solve since it’s not broken in the unmodified software.

I would recommend looking at the permissions of other files comparing them. They should essentially match. Once you set them, I would check again to make sure the change actually took effect. Ultimately file ownership and permissions is a server level function. IPS is a software package, it can't control your server or set these things for you. If your host won't assist with server level issues, I would highly recommend a new host.

This is not in the current 5.x alphas.

This is not something likely to occur. It’s not something talked about previously and IPS does not have teams of non-English speakers on staff to translate. If it is something they include by default, it becomes something they must maintain. Given the lack of resources to do so, it’s unlikely to occur.

I obviously don’t have your numbers and I don’t even know if IPS would. Those numbers are not broken down anywhere. However as I used SES for a long time, I saw my own numbers. If it is all transactional emails such as users registering, PM notifications, etc… that number will be pretty low. My site has 200-400 users at a time with more than 15K total users. We would generate no more than 100-200 in an hour. (Most mail providers don’t look at mails per hour and instead have a limit of mails per second.) But if you’re doing mass mailings to users, that number would be dramatically higher.