CleanTalk Surface.php timeouts causing customer-facing HTTP 500 errors

  • monikac

    (@monikacharrak)


    2 days, 13 hours ago

    Hello CleanTalk Support,

    we have identified a serious issue with Security by CleanTalk 2.186 on our production WooCommerce store.

    Since August 31, 2026, our WooCommerce fatal error logs contain thousands of recurring identical errors:

    Maximum execution time of 120 seconds exceeded

    File:wp-content/plugins/security-malware-firewall/lib/CleantalkSP/SpbctWP/Scanner/Surface.php

    Line:463

    The errors have continued continuously since August 31, usually around 1,500 times per day.

    We initially thought these might only be internal scanner/background errors. However, we have now correlated the CleanTalk fatal-error log with our Apache access log for September 7.

    On September 7:

    • 1,365 HTTP requests returned status 500
    • 1,326 of those HTTP 500 requests ran for approximately 122–129 seconds before failing
    • 1,234 of these long-running HTTP 500 requests terminate at the same second, or within ±1 second, as one of the recurring CleanTalk Surface.php:463 timeout fatals

    These are not limited to background/scanner endpoints. The affected requests include normal public WooCommerce/frontend traffic such as:

    • product pages
    • cart
    • checkout
    • order-received / order-pay
    • My Account
    • WordPress REST requests
    • admin-ajax requests
    • normal landing pages

    We therefore have strong evidence that the CleanTalk issue is currently causing real customer-facing HTTP 500 responses, not merely filling the error log.

    This morning, September 8, a customer also reported receiving WordPress’ generic “There has been a critical error on this website” message immediately after successfully paying via Amazon Pay at approximately 06:29 local time. The payment itself was completed successfully. Multiple identical CleanTalk Surface.php timeout fatals occurred around that time as well.

    We cannot yet correlate that particular request with today’s Apache access log because our hosting provider only makes the daily access log available after the day has ended. Therefore we are not claiming yet that CleanTalk caused this specific Amazon Pay incident, but it is consistent with the customer-facing HTTP 500 pattern we have already confirmed for September 7.

    The plugin currently shows the last completed malware scan as August 30, although these Surface.php errors started on August 31 and have continued around the clock since then.

    We can see that Security by CleanTalk 2.187 is available. However, this is a high-traffic production WooCommerce store, and we do not want to perform an unverified security-plugin update or disable the firewall without knowing that it addresses the actual problem.

    Could you please urgently confirm:

    1. Is this exact Scanner/Surface.php:463 – Maximum execution time of 120 seconds exceeded issue known in version 2.186?
    2. Does version 2.187 specifically fix this exact issue?
    3. If yes, which fix/change in 2.187 addresses it?
    4. Why is Scanner/Surface.php apparently being invoked continuously even though the last malware scan shown in the plugin completed on August 30?
    5. Is there a safe temporary way to stop only the affected Scanner/Surface process while keeping Security Firewall and WAF fully active?
    6. Is it safe to leave the current situation running, considering that we have confirmed customer-facing requests ending in HTTP 500 after approximately 120 seconds?

    We can provide the WooCommerce fatal-error logs and the Apache access log privately if you need them for investigation.

    Because this is now demonstrably affecting production HTTP requests, we would appreciate an urgent technical response rather than a general recommendation to update to the latest version.

    Thank you.

    Best regards

    Monika

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support dimitrycleantalk

    (@dimitrycleantalk)

    2 days, 12 hours ago

    Hello @monikacharrak,

    We are sorry for the inconvenience caused.

    I have forwarded the details to our development team. We will send you an update within 1-2 business days, or sooner if any results become available.

    Please wait.

    Thread Starter monikac

    (@monikacharrak)

    2 days, 11 hours ago

    Hi Dimitry,

    thank you for the fast response.

    just wanted to add an Additional finding:
    We now also have the Apache access logs for August 31, September 1 and September 2.

    The issue can be pinpointed very precisely:

    • On August 31 there were zero 120-second HTTP 500 requests before 18:07 local time.
    • At 18:07:34, a CleanTalk remote scanner request started:
      spbc_remote_call_action=scanner__controller ... stage=file_system_analysis
    • It ran for 122 seconds and ended at approximately 18:09:36.
    • The first Scanner/Surface.php:463 fatal was logged at 18:09:37.

    Immediately afterwards, normal customer-facing requests began failing with the same ~122-second / HTTP 500 pattern, including:

    • Google Ads/PMax landing pages
    • wc-ajax=update_order_review (checkout)
    • product pages
    • My Account
    • admin-ajax / REST requests

    On August 31, all 404 HTTP 500 requests with a runtime >=120 seconds match a CleanTalk Surface.php fatal within ±1 second.

    On September 1 this applies to 1,483 of 1,576 such requests (94.1%), and on September 2 to 1,293 of 1,394 (92.8%).

    This strongly indicates that the problem starts with the CleanTalk scanner process itself and is directly responsible for customer-facing HTTP 500 responses.

    Could you please specifically investigate what triggered the scanner at this time and confirm the safest immediate fix?

    thank you!

    best regards

    Monika

    Plugin Support dimitrycleantalk

    (@dimitrycleantalk)

    2 days, 10 hours ago

    Thank you for the details.

    Our developer has reviewed your issue, and updating the plugin to version 2.187 may help resolve it. Most likely, there is a file in your website folder that our scanner cannot read. Version 2.187 includes a fix for this, but since we don’t know which files are on your server, we can’t be 100% sure this will solve the issue. You can view the changes made in version 2.187 here: https://github.com/CleanTalk/security-malware-firewall/pull/721/commits

    Please try the following:

    1. Update our plugin to the latest version. The guide is here: https://cleantalk.org/help/install-wordpress-security
      Then recheck this issue.
    2. If step 1 doesn’t help, try increasing the Maximum execution time on your server. If you are not sure how to do this, please contact your hosting provider for assistance.

    Please let us know the results.

    Thread Starter monikac

    (@monikacharrak)

    2 days, 10 hours ago

    Thank you.

    Since any further troubleshooting may involve details about our security configuration and production environment, I would prefer to continue this part of the investigation privately.

    Could you please contact me directly by email using the email address associated with our CleanTalk account?

    Alternatively, if you prefer that I open a private CleanTalk support ticket, please send me the appropriate link or instructions.

    I can then provide any additional logs, timestamps and configuration details your developers need.

    Thank you.

    Plugin Support dimitrycleantalk

    (@dimitrycleantalk)

    2 days, 9 hours ago

    You can contact us via our private ticket system here: https://cleantalk.org/my/support/open

Viewing 5 replies - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.