ServerPilot.io servers

Following the other thread, the PHP script result is:

Starting session.
Checking “nfw_goodguy” session flag: ERROR: not found.

Also:

session.cache_expire 180 180
session.gc_maxlifetime 1440 1440
session.use_cookies on on
session.save_handler files files
session.save_path /srv/users/myuser/tmp/myapp idem
session.cookie_domain no value

I don’t have any caching plugin (Wordfence’s caching function is not enabled).

My Overview:

Firewall Enabled
PHP SAPI FPM-FCGI (7.0.1)
Version 1.8.3 (security rules: 2015-12-21.1)
Admin user cristian (you are whitelisted by the firewall)
User session It seems the user session was not set by the firewall script or may have been destroyed by another plugin. You may get blocked by the firewall while working from the WordPress administration dashboard.
Optional configuration file /srv/users/myuser/apps/myapp/.htninja

.htninja content:

<?php
/*
 +===================================================================+
 | NinjaFirewall optional configuration file                         |
 |                                                                   |
 | See: http://nintechnet.com/ninjafirewall/wp-edition/help/?htninja |
 +===================================================================+
*/

// To tell NinjaFirewall where you moved your WP config file,
// use the '$wp_config' variable :
$wp_config = '/srv/users/myuser/apps/myapp/wp-config.php';

// To change NinjaFirewall's log and cache folder
// use the 'NFW_LOG_DIR' constant (no trailing slash needed) :
define('NFW_LOG_DIR', '/srv/users/mysuer/apps/myapp/NFW');

$ip_array = array( 'MY IP' );
if ( in_array( $_SERVER["REMOTE_ADDR"], $ip_array ) ) {
   return 'ALLOW'; // whitelist
}

if ( $_SERVER["REMOTE_ADDR"] == '91.200.12.139' ) {
   return 'BLOCK'; // reject it
}

I’m not saying Ninja Firewall doesn’t work with PHP7, is just that in my case I cannot use Apache+PHP7 when installing NF.
The code is being added correctly to my .htaccess (Your configuration was saved.):

<IfModule mod_php7.c>
   php_value auto_prepend_file /srv/users/myuser/apps/myapp/public/wp-content/plugins/ninjafirewall/lib/firewall.php
</IfModule>

But when testing, Error: the firewall is not loaded. and I cannot find any log about what the issue may be.

But I guess is because appears like ServerPilot is not using mod_php when configuring the server, https://www.digitalocean.com/community/questions/wordpress-one-click-or-server-pilot
This is why I mentioned ServerPilot.io , they are applying a specific configuration that is working only on Ubuntu 14.04 LTS, where I can even switch with one click from PHP 5.4 to 5.5, 5.6 or 7 and downgrade as well.

The phpinfo says that my Server API is FPM/FastCGI which is not listed in the Ninja Firewall install options.

Thank you, actually using “Nginx + CGI/FastCGI” doesn’t show any alert.

Still can’t figure out why the clickjacking protection doesn’t appear to work (and that’s something simple to test – even by using http://www.lookout.net/test/clickjack.html ).

If I’m using the .htaccess it does the job, but not using NF setting. Any idea?

I have disabled Wordfence and disabled and deleted NinjaFirewall. With Wordfence disabled, I have installed back NinjaFirewall and activated. Even after that the issue is still there so is not related with Wordfence.

Also using either PHP 7.0.1, 5.6.16 or even 5.4.45, doesn’t change anything.