Replies: 0
About 2 months ago I reported a problem about the WAF unexpectedly switching to learning mode. It was suggested that this might have been caused if the wp-content/wflogs/ had been deleted. At the time there were still some files in this directory which predated the switch to learning mode indicating that it had not been deleted. I switched the WAF back to enabled mode and confirmed that things remained stable and the issue was marked as resolved.
Unfortunately the problem has now returned and the WAF has reverted to learning mode. It’s currently due to automatically revert to enabled mode on 07/25/2017 06:14pm +0100. Assuming the automatic learning mode was switched on for one week then I assume it started on 07/18/2017 06:14pm +0100.
It may be just coincidence but Wordfence was recently updated to 6.3.14. The files in wp-content/plugins/wordfence are all dated Jul 17 20:11, i.e. shortly before the switch to learning mode. Could this be relevant?