Full WAF mode cannot be enabled although auto_prepend_file is correctly loaded

Hello,

I’m trying to enable Full WAF mode on a completely fresh WordPress installation, but NinjaFirewall always reports that Full WAF is not enabled, although all technical requirements appear to be met.

Before opening this topic, I searched through several existing support threads here on WordPress.org and elsewhere regarding Full WAF activation issues. While I found a number of similar reports, none of them provided a solution that resolved my issue. Therefore, I decided to document all of my findings in detail here in the hope that they may help identify the underlying cause.

To save time, I used AI to help structure and summarize my findings for this report. However, I personally performed and verified all of the tests described above, and everything stated here has been confirmed by me.

Environment:

• NinjaFirewall (WP Edition) 4.8.7
• WordPress 7.0 (latest)
• PHP 8.3 (also reproduced with PHP 8.5)
• PHP SAPI: fpm-fcgi
• Web server: Apache + PHP-FPM
• Hosting: webgo Shared Webhosting (CloudLinux + PHP-FPM)

This is not an isolated case. I also have a customer running PHP 8.3 with the latest WordPress and NinjaFirewall who experiences exactly the same issue.

No other security plugins is active. Only the NinjaFirewall “auto_prepend_file”-Setting is in the .user.ini-file.

What happens

Regardless of which server type is selected in the installer (Apache + CGI/FastCGI, LSAPI, etc.), the activation always fails with:

NinjaFirewall detected that the requested changes seemed to crash your blog. The website front-end did not return the expected page. Changes have been undone.

When choosing the manual installation method and configuring everything manually, the plugin still reports:

Oops! Full WAF mode is not enabled yet.

Server-side verification

To verify whether this is a hosting/PHP issue, I created several standalone PHP test scripts inside the WordPress root.

The results are:

PHP SAPI:

fpm-fcgi

ini_get('auto_prepend_file')

returns

/home/www/testest123/wp-content/nfwlog/ninjafirewall.php

phpinfo():

The auto_prepend_file-Configuration in the phpinfo section shows:

Local Value:
/home/www/testest123/wp-content/nfwlog/ninjafirewall.php

Master Value:
no value

This is exactly what is expected when using .user.ini with PHP-FPM.

Additional verification

I also verified:

file_exists('/home/www/testest123/wp-content/nfwlog/ninjafirewall.php')

Result:

bool(true)

and

is_readable('/home/www/testest123/wp-content/nfwlog/ninjafirewall.php')

Result:

bool(true)

Directory verification

echo __DIR__;

returns

/home/www/testest123

which matches the configured auto_prepend_file path.

.user.ini:

The .user.ini contains:

auto_prepend_file="/home/www/testest123/wp-content/nfwlog/ninjafirewall.php"

No other active auto_prepend_file directives exist.

Wordfence is not installed (clean installation).

PHP cache:

I also waited longer than the configured

user_ini.cache_ttl = 300

and repeated the tests. The result remains the same.

NinjaFirewall internal phpinfo

One thing I noticed:

My own phpinfo() page inside the WordPress root correctly shows the auto_prepend_file configuration:

https://www.web199.s153.goserver.host/info.php

However, NinjaFirewall’s internally generated phpinfo page does not display the auto_prepend_file entry at all. (Generally, no core values.):

This makes me suspect that NinjaFirewall’s internal verification routine may not be reading the PHP configuration in the same way as PHP itself.

Additional testing

To rule out server configuration issues, I created several temporary PHP test files to verify:

• ini_get()
• phpinfo()
• file_exists()
• is_readable()
• directory paths (__DIR__)
• .user.ini loading

All of these tests succeeded.

Server-side, everything appears to work correctly.

Server logs

The hosting provider also checked the server side. No cause could be identified.

The server error logs contain no PHP errors, warnings or fatal errors during activation.

I’ve also enabled the WP error log, but no log file has been created yet.

Conclusion

At this point it appears that:

• PHP-FPM correctly loads .user.ini
• auto_prepend_file is active
• the configured file exists
• the configured file is readable
• the configured path is correct
• no server-side errors occur

Yet NinjaFirewall still reports that Full WAF is not enabled.

Could this be an issue with the Full WAF detection routine, especially when running under PHP-FPM/CloudLinux?

I also couldnt find the solution with AI. If there is any additional debug mode or diagnostic logging available for the Full WAF verification process, I’d be happy to test it.

Thank you very much.

• This topic was modified 1 month ago by Serhat K..
• This topic was modified 1 month ago by Serhat K..