WordFence results in 503: all sites down on server

Resolved

(@jjw-1)

This morning our server was hit with a 503 on all domains. Plesk support noticed the behaviour on one of the domains with the WordFence plugin installed:
Indeed, over /var/www/vhosts/domain.com/logs/proxy_error_log you may see it's causing the errors, for example:

2023/01/13 12:52:40 [error] 30093#0: *498839 FastCGI sent in stderr: "PHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refused" while reading response header from upstream, client: 143.244.xx.xx, server: domain.com, request: "GET /wp-admin/admin.php?page=WordfenceSupport HTTP/2.0", upstream: "fastcgi://unix:/var/www/vhosts/system/domain.com/php-fpm.sock:", host: "domain.com", referrer: "https://domain.com/wp-admin/admin.php?page=Wordfence"

Leading to the errors over /var/www/vhosts/domain.com/logs/error_log:

[Fri Jan 13 12:53:12.889746 2023] [proxy_fcgi:error] [pid 5549:tid 139794516526848] [client 23.90.xx.xxx:38646] AH01071: Got error 'PHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refusedPHP message: Connection refused

Kindly ask customer to disable and reconfigure the plugin, using the following documentation: (link to WP Toolkit)

Removed the WF plugin, but would like to use it again because of security. Is this a known error?

Viewing 2 replies - 1 through 2 (of 2 total)

Plugin Support wfpeter
(@wfpeter)

2 years, 4 months ago

Hi @jjw-1, thanks for your message.

Are you able to reenable Wordfence plugin under normal circumstances when you’re not receiving these errors? The reason I ask is because it looks to me like IP detection or specific configuration for your environment could need to be changed. I wouldn’t necessarily expect Wordfence to directly be causing “Connection Refused” type messages, but there may be issues with it running on your server with current settings.

If you can send a diagnostic report to wftest @ wordfence . com using the link at the top of the Wordfence > Tools > Diagnostics page, I can look into this further for you. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,
Peter.

Thread Starter Jeroen
(@jjw-1)

2 years, 4 months ago

Hi Peter, thanks for your reply. Today this happened again on a site without the Wordfence plugin. So we are looking into this problem somewhere else. As it seems it has something to do with caching and W3TC plugin + PHP 8.1xx.

The error log probably stated Wordfence since the error occurred while customer was visiting the Wordfence page.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘WordFence results in 503: all sites down on server’ is closed to new replies.