Site Scan Error After Enabling Basic Auth

Hi, @shanedelierrr

Sorry for replying late as this item was deprioritised on my end previously.

Can you please confirm if the Site Scan ever had a successful scan on your site before?

Yes.

Can you please confirm if the Site Scan ever had a successful scan on your site before? If so, it started having issues after enabling basic auth, but when you tried removing basic auth it did not help, correct?

Yes & yes, but sometimes (even with Basic Auth still enabled) it might still be successful.

Is your site publicly accessible? If so, can you please double-check that the Licensed URL in WP Admin > Settings > SolidWP Licensing is correct? Please try also to re-license the plugin after saving the correct Licensed URL.

Yes, publicly accessible but we’re not licensed. We’re using the free iThemes security plugin.

If the issue persists, please try to whitelist the Site Scanner’s IP address via NGiNX Ingress to bypass the basic auth.

Will consider doing this, thank you! Though It’s worth noting that all successful attempts we’ve had so far, had never needed this whitelisting to be done.

Additionally, here’s more context. Usually when it’s successful (do note that the difference in URL, i.e. url =>), the logs would look like this:

id               => 3674473
module           => site-scanner
type             => critical-issue
code             => vulnerable-software
timestamp        => 2024-08-15 15:09:37
init_timestamp   => 2024-08-15 15:09:36
remote_ip        => 204.246.166.146
user_id          => [empty string]
url              => https://www.<REDACTED>.com/
memory_current   => 8295960
memory_peak      => 8497448
data             => Array
    results   => Array
        url       => https://www.<REDACTED>.com
        version   => 1.0
        entries   => Array
            blacklist         => Array
                0   => Array
                    report_details   => https://transparencyreport.google.com/safe-browsing/search?url=www.<REDACTED>.com
                    status           => clean
                    vendor           => Array
                        slug    => google
                        label   => Google Safe Browsing
            vulnerabilities   => Array
                0    => Array
                    type     => wordpress
                    issues   => Array
                        0   => Array
                            title               => WordPress core < 6.5.5 - Contributor+ Path Traversal (Windows Only) vulnerability
                            description         => Contributor+ Path Traversal (Windows Only)

When it’s failing (10.1.0.1 is a sample of internal IP):

id               => 3674444
module           => site-scanner
type             => warning
code             => scan-failure-client-error
timestamp        => 2024-08-15 03:09:34
init_timestamp   => 2024-08-15 03:09:32
remote_ip        => 10.9.68.67
user_id          => [empty string]
url              => https://10.1.0.1:8443/wp-login.php
memory_current   => 7858472
memory_peak      => 7895080
data             => Array
    results   => Object WP_Error
        errors       => Array
            site_verification_failed.private_host   => Array
                0   => Unable to determine if the scan target is allowed: Scan target is not publicly accessible.
        error_data   => Array
            site_verification_failed.private_host   => Array
                url   => https://10.1.0.1:8443
    cached    => [boolean] false

My next few questions are:

• Am aware that free and paying are able to do site scan, but is paying necessary for specific support to resolve this issue?
• How is the URL get decided or set when scan is triggered? With the same WordPress instance, we would occasionally see it in the form of public URL or internal private IP otherwise.
• Is it correct to assume the site scanning will always be done successfully via public internet? Or it will fail otherwise?

Thanks for reading & looking forward to your further assistance, appreciate it!

Hi @shanedelierrr,

Any updates so far?

Hi @shanedelierrr,

Apologies for the late response as well, I have already reached out as per instructed.

Looking forward to your/SolidWP’s support, thank you & appreciate it!