Delete LCK files on remote remote

[StricklySpeaking]

I am working with a web site previously build using wordpress. The fellow who built the site passed away. It looks like many files in the site had a LCK on them. I would like to delete all the files in all folders with a LCK extension. I have deleted a few by hand and don't see any issues created in Dreamweaver.

I set up a remote server and looked at the folders using "Expand to show local and remote" thinking I could use this tool to hand delte files. LCK files are filtered and don't show up.

What I really would like is a way to clean them all out like "rm -r *.LCK" in linux. This does not work on FTP site. I wish there was a flag in SITE sync to remove files from remote that do not exist in the local.

Is there a way to clean off all the LCK files on the remote?

[Nancy OShea]

WordPress is open source and highly vulnerable to code injection and hacking by bad actors.

An LCK file is an access control file used to "lock" a database or other mission critical file from being opened or changed by more than one user at a time.  The former web developer must have had good reasons for doing this. Removing LCK could in fact be doing more harm to site security than you realize.

I defer to WordPress about the need to harden files for increased web security.

https://wordpress.org/support/article/hardening-wordpress/

[Nancy OShea]

If you're no longer using WordPress, you should start over with a new site site definition in a separate folder.

Use a dedicated S/FTP client like FileZilla to manage files on remote server.  Or ask your hosting provider to assist with removal of WordPress files from your server. 

[StricklySpeaking]

Thanks for your comments and feedback…

Nancy:
This site has been around over 10 years and the sftp download is almost 3GB. Also, this is a non profit organization so nobody paying for the work. Not a good idea to start over at this point just keep hacking and fixing with incremental improvements.

One or more of the people which may help maintain the Web page know Wordpress and I know Dreamweaver as a novice. Don’t really want to add Wordpress to my system because I feel Dreamweaver is a better product.

LCK file does not seem to be much security. I have been able to just write over the files with any changes I wanted with a warning from Dreamweaver. Seems only security is having the login cridentials. I have made full backups of everything and others have as well so we can go backwards if needed.

I decided to just walk through most of the folders and hand delete the LCK files which I have done. No negative issues seen so far.
I am sure there are snakes in the bushes though.

Anyway thanks for your feedback a lot.

[BenPleysier]

I'm with Nancy, if you want to get rid of Wordpress then you should start over.

The point is, the site is a Wordpress site. Then why are you not using Wordpress to update the site. This is done on the remote server and requires no files to be uploaded or using FTP or similar. Why are you using Dreamweaver???

When you say that Dreamweaver is a better product, what you are really saying is that Wordpress is inferior. I totally agree. But that should not be the issue in your case. A 3GB (ouch!) site must have plenty to talk about and to convert that from a Wordpress site to something more sensible is a mamouth task.

If I were in your shoes, I would stick with Wordpress and not fiddle with anything that could harm the site. Tears come to mind when I think of the consequence.

But I am me. I would use Wappler to create a NodeJS site which is much leaner and faster. Easier to maintain and understand.

[Nancy OShea · Accepted solution]

I'm sorry to say this but the road to hell is paved with good intentions. You don't know what you don't know.  

WordPress is not a static site. Yet you take it upon yourself to edit files in Dreamweaver and remove LCK files without knowing what they do??  I'm not being hyperbolic when I say this is crazy dangerous!   

Owing to how WP works, there are no real pages to edit in Dreamweaver.  WordPress pages are assembled on the fly by the server with PHP scripts and content stored in the MySQL database.  

If you don't like the site's appearance, change themes from the WordPress admin panel.  There are thousands of free and premium WP Themes available from various marketplaces.  Many are specifically tailored for NGOs, churches/fellowships, membership clubs, etc....

Styles and content are edited from within the WP dashboard, not by outside editors.  Again, none of this requires Dreamweaver.  And removing LCK files serves no purpose other than playing Russian Roulette with a site you don't own and probably have no business working on. 

Before you proceed, please discuss your intentions with the stakeholders.  They must make informed decisions about whether you should continue or not.  A site this size is not a toy for you to play with.

[StricklySpeaking]

Hi Nancy,

Thanks for being so persistent.

I will assume you know what you are talking about and work with Wordpress.

I can put the LCK files back with a simple script or just roll back to a previous backup.
It will be interesting to learn how to replace the lock files from the guy that died in 2019 and add LCK files
to all the files that have been created since if they are needed.

This statement:

"Owing to how WP works, there are no real pages to edit in Dreamweaver. WordPress pages are assembled on the fly by the server with PHP scripts and content stored in the MySQL database. "

This statement was helpful to me. Really we have only been editing the PHP files so this is why we have not gotten into any real trouble.

Not about to make any real serious changes to structure of the site. Just maintain it going forward.

I did get the feedback I was looking for here.

Sleep well, and thanks again.

Bob

[StricklySpeaking]

It turns out the site was not using Wordpress at all. There is almost no data in the SMB database also. Aparently, other packages can create LCK files or it was created on another system and dropped in.  Anyone reading this thread should be carefull with the advice provided here. 

Removing the LCK has caused no problems to date so I think we will not be adding them back in at this point.

I manually removed the files. I see now the CPannel has an ability to allow ssh connections. By doing this one could make a connection via ssh and then remove LCK or other files using linux commands.  This will depend on your web host provider though.

Bob

[osgood_]

The advice provide here is based on the information provided.

 Quote:

'I am working with a web site previously build using wordpress'.

As you say, anyone reading this best make sure they supply information which is correct, not some made-up fiction.

[Nancy OShea]

Yes, many web apps use LCK files for SECURITY; not just WordPress. 

I mean no disrespect.  And I'm not raising false red flags when I say that tampering with sh*t you don't understand is unsafe practice that could cause great problems later.  This is a public user forum.  It's our responsibility to discourage unsafe practices when we see them.  Anyone who sees this, please proceed with utmost caution when it concerns security.  At the very least, talk to your hosting provider or consult with an experienced web professional.

[Jon Fritz]

On the less alarming side of things...

.LCK files are also used by DW's built in Check-In/Out feature. That function is used when a group of developers are editing pages and don't wish to accidentally overwite each others work. DW uses the .LCKs to determine if a file is currently checked out and unavailable, or if it can be worked on by another member of the development team. 

If more than one person were using DW in the past to create the site you are currently working on, and forgot to check files back in, it's possible the .LCKs you're seeing are from that and have nothing to do with capital-S Security.

Those files will have either a name or an email as the only information within them. If you open one of the .LCK files you have in a text editor, what are you seeing?

[StricklySpeaking]

Thank you Jon.  You are correct the files have the name of the developer and his email. 

Interesting they may have originated from DW and there does not seem to be any comments about removing them within DW.  The SYNC tool should offer an option to deal with files deleted and it does not seem to do this.

I once developed ICs and keeping track with who was in a Verilog or other code database was very important. Less so here it seems.

It did feel strange when the fellows name came up when he passed away several years ago. I guess DW knew how to get the name out of the file and use it.

Thanks for your posting.