WordPress.org Forums » [Wordfence Security - Firewall, Malware Scan, and Login Security] Support

It says no IP addresses have been blocked yet.

Yup. Did a control F5 and also used IE, FF and Chrome. Same with them all. I've created an htaccess directive to force the www, which works but there's obviously something odd going on.

rename what file? the tmp...?
also, what should be recreated?

Ah good call wsafa, it was only set to 10 minutes. I have increased it now.

Thank you.

Thank You!

I'll give your suggestion a go!

Hi webeno,

Sorry for the late reply. I indeed can confirm this is normal behavior.

Hi Josiah,

Is this a plugin or theme's readme.txt? If so, can you let me know which one?

Hi elovkoff,

Can you confirm the version of litespeed you are running?

If you could, turn on "Enable debugging mode" at the bottom of the Diagnostics page, and run a scan. Then copy & paste the last 10 to 20 lines of the 'Scan Detailed Activity' box here. Please verify there is no sensitive data in the log before pasting.

Thanks.

It's a plugin. A prefer not posting in a public place information about what might be installed in my system, together with its putative vulnerabilities. I would be happy to send the file to a private address at wordfence.

Caution is always a good thing. Feel free to send the file here. wftest@wordfence.com

Hi wflandon,

Thanks. Can you explain why please?

ps.: that "...stray ''..." was supposed to read many backslashes and and zeros one after the other, like in the example, but I guess you got it.

Hi zamano,

Have you checked spam? Occasionally these types of emails end up in spam. And every now and then they are filtered out completely before getting to you.

I might try temporarily changing the email address to a different provider, than the one you currently use, and see if you receive the alerts. If you do, its possible that the emails are sending correctly but being filtered out before they even get to you.

Let me know what you find out.

Hi justdave,

I do not believe that is currently possible. However, I will forward this a long to the team as a feature request.

when i go to the wordfence/tmp file this is what it shows...
/<?php/* Wordfence temporary file security header */
echo "Nothing to see here!\n"; exit(0);
?>a:13:{s:6:"apiKey";s:160:"1eca4f8117ea2e747d3b421dbca1edad2cde31a9da43a0d20c4cdd82b428a79a644ec09494ce526b0893e12bcd1968ce9c6aecf933e082ac845f14b96e58d3a4492a6e653f1f8465c9a27cd0318204cc";s:9:"howGetIPs";s:0:"";s:11:"whitelisted";s:0:"";s:9:"cacheType";s:0:"";s:20:"loginSec_lockoutMins";s:3:"240";s:19:"other_hideWPVersion";s:1:"1";s:33:"scansEnabled_suspiciousAdminUsers";s:1:"1";s:18:"liveTrafficEnabled";s:1:"1";s:6:"isPaid";s:0:"";s:15:"firewallEnabled";s:1:"1";s:14:"disableCookies";s:1:"0";s:18:"liveTraf_ignoreIPs";s:0:"";s:17:"liveTraf_ignoreUA";s:0:"";}/

Hi,

max execution time is 30

so like you say i set up to 20.

here the log :

[May 24 17:28:35] Contacting Wordfence to initiate scan
[May 24 17:28:36] Getting plugin list from WordPress
[May 24 17:28:36] Found 9 plugins
[May 24 17:28:36] Getting theme list from WordPress
[May 24 17:28:36] Found 3 themes
[May 24 19:28:28] Scan kill request received.
[May 24 19:28:54] Contacting Wordfence to initiate scan
[May 24 19:28:55] Getting plugin list from WordPress
[May 24 19:28:55] Found 9 plugins
[May 24 19:28:55] Getting theme list from WordPress
[May 24 19:28:55] Found 3 themes
[May 24 19:29:00] Analyzed 100 files containing 1.14 MB of data so far
[May 24 19:29:02] Analyzed 200 files containing 1.99 MB of data so far
[May 24 19:29:04] Analyzed 300 files containing 3.84 MB of data so far

And then nothing...

Actually, no. I can’t confirm it was WordFence. The reason is that I had a second plugin that limits the number of login attempts. The problem occurred when the admin login for WP suddenly refused to recognize my p/w. This appears to have occured when someone or something changed my .htaccess and php.ini files in file manager. I successfully reset the p/w on one of two sites. The second site would not allow me to change the p/w and then blocked all attempts at entering.

Folllowing the WordFence online instructions on WP.org I changed the WordFence, cache, and login plugin folder names. It still did not allow access. I then changed the name of the easycaptcha plugin and access was allowed.

Was it WordFence? I thought it was. Was it the limit login program or was it easycaptcha? I have been using all three for some time without a problem. I still do not know who accessed my .htaccess files.

Thank you for responding to this post.

Hello Dan!
A fix is on the way in one of the upcoming releases. However, I just wanted to add note here that if you run wp-cron with wget/curl instead you will not get this error message. Running it with wget/curl is a bit more in line with how WordPress works too so unless you have a particular reason for not doing it that way I would recommend it.

Hi wflandon,

Thanks for the reply. Disabling "Enable SSL Verification" did not help.

I notice in the logs that the automatically scheduled scans seem to be completing successfully (in just a little over one minute). But no manual scans ever make it past the spot you see in my original post.

Hello,
yes, that file is called configCache.php, correct? Just rename it to _configCache.php or something like that and then try to run your update.

floatingkitch on "[Plugin: Wordfence Security] Blocking not working?"

Lockhart on "[Plugin: Wordfence Security] Website Fatal Error if I try to use url without the 'www'"

pilardavis on "[Plugin: Wordfence Security] Update Will Not Install"

alistairgd on "[Plugin: Wordfence Security] locked out log empty"

digitalcam on "[Plugin: Wordfence Security] Getting Pass .htaccess - How Are They Doing This?"

wflandon on "[Plugin: Wordfence Security] phpMyAdmin database dump with '\....0' at the end of field definition"

wflandon on "[Plugin: Wordfence Security] Scan false positive"

wflandon on "[Plugin: Wordfence Security] Scan don't start"

Josiah S. Carberry on "[Plugin: Wordfence Security] Scan false positive"

wflandon on "[Plugin: Wordfence Security] Scan false positive"

webeno on "[Plugin: Wordfence Security] phpMyAdmin database dump with '\....0' at the end of field definition"

wflandon on "[Plugin: Wordfence Security] Wordfence scan email alerts"

wflandon on "[Plugin: Wordfence Security] IP whitelist for user login alerts?"

pilardavis on "[Plugin: Wordfence Security] Update Will Not Install"

EBrockway on "[Plugin: Wordfence Security] Scan not performing"

rogerpoole on "[Plugin: Wordfence Security] hacked by Pak Haxor experience"

sanchell2 on "[Plugin: Wordfence Security] Locked out"

wfasa on "[Plugin: Wordfence Security] PHP Notice"

TheRealMikeD on "[Plugin: Wordfence Security] Wordfence Scan Never Completes"

wfasa on "[Plugin: Wordfence Security] Update Will Not Install"