I got a bit further by resetting to the default settings, but it’s still stalling. This time at “Analyzed 11400 files containing 233.91 MB of data so far”
Hi @knittingand,
It looks like a potential timeout in the middle of scanning files, so if your server uses Litespeed, adding the noabort code prevents in-progress scans terminating: https://www.wordfence.com/help/advanced/system-requirements/litespeed/
If that’s not the case, a scan log and site diagnostic should help us out:
- Go to the Wordfence > Tools > Diagnostics page
- In the “Debugging Options” section, check “Enable debugging mode”
- Click to “Save Changes”.
- CANCEL any current scan and start a NEW scan
- Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log once the scan finishes and paste them in this post.
You can then send a diagnostic report to wftest @ wordfence . com from the top of the Wordfence Tools > Diagnostics page. Click on “Send Report by Email”.
Please add your forum username where indicated and respond here after you have sent it because the inbox is not monitored.
Many thanks,
Peter.
There wasn’t any option to add my forum username when I sent it but you’ll see it’s obvious in the logs.
I had to stop the scan when it stalled. I just had my server upgraded due to maxing out services so hopefully if they’ve put a limit on services anywhere I can change it now if necessary.
Hi @knittingand,
The activity log that you’ve sent over is different to the Scan Log and Diagnostic report so that’s why there was no username prompt. I found it though and it will likely help in conjunction with your Diagnostic, which I will still need to know a little more about your server setup.
At the top of the Wordfence Tools > Diagnostics page there’s a blue “SEND REPORT” button that opens up a short form where you can enter your username before hitting “SEND”.
Thanks again,
Peter.
Done! Thanks for the clarification.
Hi @knittingand, thank-you for sending that over.
This is an interesting one. I would say your overall settings, server setup and other factors (like quantity of installed plugins) look like scans should be completing successfully. I will say that we have historically seen scan issues on your host in the past that were resolved by them adjusting the server’s firewall configuration. It could be worth checking in with your host’s support to see if they have knowledge of why Wordfence scans might be failing.
If they have no specific known reason, I have some further ideas. I know you’ve already tried low resource scanning, but the other suggestions in conjunction with that setting might help.
Set Wordfence > All Options > Performance Options > Maximum execution time for each scan stage to a number like 15 and keep “Use low resource scanning” checked to help spread the scan out a bit more or at least keep memory usage for each hit lower. Don’t forget to save changes there after you’re done.
In addition, consider:
- Adding more cache paths (if applicable) in Wordfence > All Options > Advanced Scan Options > Exclude files from scan that match these wildcard patterns such as:
wp-content/cache/*
- Keeping Wordfence > All Options > General Options > Scan images, binary, and other files as if they were executable disabled.
- Setting an overall scan time limit in Performance Options of around 3 hours.
Let us know how you get on,
Peter.
my web host says they increased my php limit and that scans are running for them, but they’re still failing for me.
I don’t think they’re running a manual scan, just looking at the results of the latest automatic quick scan.
I’ve tried all your suggestions from the previous message as well, to no avail.
-
This reply was modified 2 months, 1 week ago by
knittingand.
Hi @knittingand, thanks for the update.
I think because you’ve tried changing some Wordfence settings, and your host has also made a change, a new scan log would be beneficial for us to see exactly where the scan is up to before it fails now.
- Go to the Wordfence > Tools > Diagnostics page
- In the “Debugging Options” section, check “Enable debugging mode”
- Click to “Save Changes”.
- CANCEL any current scan and start a NEW scan
- Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log once the scan finishes and paste them in this post.
Thanks again,
Peter.
Thanks. I’ve sent the report via email.
Hi @knittingand,
Please follow the steps above to paste the 20 lines or so lines from the log here that show the scan finishing (even if it finishes with an error or by timeout). The reason detailed there may be the key to finding the solution.
Thanks,
Peter.
[Jun 02 10:56:02:1780361762.189512:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/v2.27/?k=7985c6a0b6def45dcfac07f16ad40d352c874cb4f4aaf8df425007f83ba31db67251148dd84359bc0838703a28a853829ad2ff64f63a138a87e983d11bccec37ff65decc1f273cc8773d057560388a7a&s=eyJ3cCI6IjcuMCIsIndmIjoiOC4yLjIiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wva25pdHRpbmctYW5kLmNvbSIsInNzbHYiOjI2OTQ4ODMxOSwicHYiOiI4LjQuMjEiLCJwdCI6ImZwbS1mY2dpIiwiY3YiOiI3LjYxLjEiLCJjcyI6Ik9wZW5TU0xcLzEuMS4xayIsInN2IjoiQXBhY2hlIiwiZHYiOiIxMC42LjI3LU1hcmlhREIiLCJsYW5nIjoiZW5fQVUifQ&action=resolve_ips
[Jun 02 10:56:01:1780361761.947022:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/stats.json
[Jun 02 09:47:28:1780357648.638232:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/v2.27/?k=7985c6a0b6def45dcfac07f16ad40d352c874cb4f4aaf8df425007f83ba31db67251148dd84359bc0838703a28a853829ad2ff64f63a138a87e983d11bccec37ff65decc1f273cc8773d057560388a7a&s=eyJ3cCI6IjcuMCIsIndmIjoiOC4yLjIiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wva25pdHRpbmctYW5kLmNvbSIsInNzbHYiOjI2OTQ4ODMxOSwicHYiOiI4LjQuMjEiLCJwdCI6ImZwbS1mY2dpIiwiY3YiOiI3LjYxLjEiLCJjcyI6Ik9wZW5TU0xcLzEuMS4xayIsInN2IjoiQXBhY2hlIiwiZHYiOiIxMC42LjI3LU1hcmlhREIiLCJsYW5nIjoiZW5fQVUifQ&action=aggregate_stats
[Jun 02 07:37:41:1780349861.616587:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/v2.27/?k=7985c6a0b6def45dcfac07f16ad40d352c874cb4f4aaf8df425007f83ba31db67251148dd84359bc0838703a28a853829ad2ff64f63a138a87e983d11bccec37ff65decc1f273cc8773d057560388a7a&s=eyJ3cCI6IjcuMCIsIndmIjoiOC4yLjIiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wva25pdHRpbmctYW5kLmNvbSIsInNzbHYiOjI2OTQ4ODMxOSwicHYiOiI4LjQuMjEiLCJwdCI6ImZwbS1mY2dpIiwiY3YiOiI3LjYxLjEiLCJjcyI6Ik9wZW5TU0xcLzEuMS4xayIsInN2IjoiQXBhY2hlIiwiZHYiOiIxMC42LjI3LU1hcmlhREIiLCJsYW5nIjoiZW5fQVUifQ&action=verify_googlebot&ip=216.74.80.211
[Jun 02 06:58:16:1780347496.521078:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/v2.27/?k=7985c6a0b6def45dcfac07f16ad40d352c874cb4f4aaf8df425007f83ba31db67251148dd84359bc0838703a28a853829ad2ff64f63a138a87e983d11bccec37ff65decc1f273cc8773d057560388a7a&s=eyJ3cCI6IjcuMCIsIndmIjoiOC4yLjIiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wva25pdHRpbmctYW5kLmNvbSIsInNzbHYiOjI2OTQ4ODMxOSwicHYiOiI4LjQuMjEiLCJwdCI6ImZwbS1mY2dpIiwiY3YiOiI3LjYxLjEiLCJjcyI6Ik9wZW5TU0xcLzEuMS4xayIsInN2IjoiQXBhY2hlIiwiZHYiOiIxMC42LjI3LU1hcmlhREIiLCJsYW5nIjoiZW5fQVUifQ&action=resolve_ips
[Jun 02 06:56:59:1780347419.006926:4:info] Entering start scan routine
[Jun 02 01:36:36:1780328196.334002:4:info] Calling Wordfence API v2.27:https://noc1.wordfence.com/v2.27/?k=7985c6a0b6def45dcfac07f16ad40d352c874cb4f4aaf8df425007f83ba31db67251148dd84359bc0838703a28a853829ad2ff64f63a138a87e983d11bccec37ff65decc1f273cc8773d057560388a7a&s=eyJ3cCI6IjcuMCIsIndmIjoiOC4yLjIiLCJtcyI6ZmFsc2UsImgiOiJodHRwczpcL1wva25pdHRpbmctYW5kLmNvbSIsInNzbHYiOjI2OTQ4ODMxOSwicHYiOiI4LjQuMjEiLCJwdCI6ImZwbS1mY2dpIiwiY3YiOiI3LjYxLjEiLCJjcyI6Ik9wZW5TU0xcLzEuMS4xayIsInN2IjoiQXBhY2hlIiwiZHYiOiIxMC42LjI3LU1hcmlhREIiLCJsYW5nIjoiZW5fQVUifQ&action=verify_googlebot&ip=185.171.254.192
[Jun 01 22:35:57:1780317357.284098:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/wonderful-insertion-100x100.jpg
[Jun 01 22:35:57:1780317357.283797:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/wonderful-insertion-100x100.gif
[Jun 01 22:35:57:1780317357.283478:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans.jpg.webp
[Jun 01 22:35:57:1780317357.283202:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans.jpg
[Jun 01 22:35:57:1780317357.282874:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-60x60.jpg.webp
[Jun 01 22:35:57:1780317357.282547:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-60x60.jpg
[Jun 01 22:35:57:1780317357.282263:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x200.jpg.webp
[Jun 01 22:35:57:1780317357.281958:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x200.jpg
[Jun 01 22:35:57:1780317357.281615:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x166.jpg.webp
[Jun 01 22:35:57:1780317357.281223:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x166.jpg
[Jun 01 22:35:57:1780317357.280903:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x133.jpg.webp
[Jun 01 22:35:57:1780317357.280582:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x133.jpg
[Jun 01 22:35:57:1780317357.280220:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x125.jpg.webp
[Jun 01 22:35:57:1780317357.279891:4:info] Skipping unneeded hash: /home/knittingand/public_html/wp-content/uploads/2018/05/womans-200x125.jpg
Hi @knittingand,
Looking at the scan logs you sent us earlier along with the recent log above, it looks like the scans are being silently stopped by something on your server, as the logs just end without explanation or a clear error. Resource restrictions look like they may be in place, but your host would know more unless your PHP error logs reveal some clues around the times scans are ending. We’d be happy to see those if you were willing to send them over?
You could try running a scan with Wordfence > All Options > Performance Options > Maximum execution time for each scan stage to 8 (the lowest) to see if that helps.
Thanks again,
Peter.
I’ll send them to the email address in wordfence if that’s ok? I don’t know enough about the info they contain to know if there’s anything sensitive in there. There are errors showing up on a regular basis.
Hi @knittingand,
Yes, that’s absolutely fine to send logs privately to wftest @ wordfence . com. Just make sure to include your forum username in the email’s subject line and let us know here once it’s sent.
Thanks again,
Peter.
Hi @knittingand,
During routine maintenance I found an error log sent from you although we weren’t notified it’d been sent here. I just wanted to note a finding:
[27-Apr-2026 20:30:08 UTC] Cron unschedule event error for hook: wordfence_batchReportFailedAttempts, Error code: could_not_set, Error message: The cron event list could not be saved., Data: {"schedule":false,"args":[]}
The above message appears fairly infrequently but seems to be benign and not related to failed scans. It actually looks like a race condition where the cron had already been unscheduled but another attempt was made.
Looking again at your diagnostic and settings changes we’ve already attempted, I don’t see a good reason for scans being terminated unless there are further settings your host is controlling around resources or timeouts that we’re unaware of.
Interestingly the frequently reoccurring line below doesn’t sound too serious but if garbage collection doesn’t run properly, old session files may accumulate and consume disk space over time. That could affect resource availability to scans:
[02-Jun-2026 02:30:02 UTC] PHP Warning: PHP Startup: session.gc_divisor must be greater than 0 in Unknown on line 0
Many thanks,
Peter.
-
This reply was modified 1 week, 6 days ago by
wfpeter. Reason: Added note about garbage collection issue
