Support » Plugin: Wordfence Security - Firewall & Malware Scan » WordFence seems blocking my site !

  • Resolved ecollart

    (@ecollart)


    Hello,

    my site sudeenly stopped responding yesterday around midnight while I was working.

    My hosting provider solved the problem by restoring the folder wflogs to a previous version !
    After that, the site ran for 15 to 30 minutes then went down again.
    Restoring again wflogs works for some time only but I was not able to find from where the problem is coming so I need your help…
    This site is actually down and reports error as below:

    504 Gateway Time-out
    The server didn’t respond in time.

    Thanks for help

    Eric Collart

    PS: I have copies of wflogs folder at problem time but I am concerned to post it here for privacy reason if any…

    The page I need help with: [log in to see the link]

Viewing 12 replies - 1 through 12 (of 12 total)
  • Hi @ecollart,

    This is most likely due to the fact that permissions on the wflogs folder or on some of the files it contains, are being changed after it is created (or restored) most likely by a cron job (hence the regularity) –by the way, you can simply delete the wflogs folder and let it be recreated (which will happen as soon as there is a new visit on your site).

    Do you notice a change of ownership/permissions on the wflogs folder itself and/or the files it contains before you delete/restore it and after it’s recreated/restored?
    Note that you will need to go in and set the Firewall back to “Enabled and protecting” as it will default to “Learning mode” when you delete the wflogs folder.

    Also could you please confirm which hosting provider you’re using?

    • This reply was modified 2 years, 3 months ago by wfyann. Reason: Additional info

    I will do that test on permission but I have strong suspicion on plugin Mailpoet 3 as site is up since yesterday when I de-activated that plugin…
    I used Maipoet 2 previously and never had any hickup…

    Provider is Nuxit.
    My site was moved to a new platform for lazy mail problem, accumulation of cron jobs and some SSL related problem (TLS 1.2) with PDF & Print by BestWebSoft plugin; those problems are solved.

    Thanks a lot for your support, I’ll post results soon…

    Eric Collart

    Mailpoet 3 is just a suspicion, could also be the provider’s new platform and/or what happends on new visit (about no traffic on that site as it is a test one.

    Eric

    Hello,

    Actually my site is working fine, permissions on wflogs foler are 755.
    if I delete wflogs folder and let it recreated by WordFence at first visit, permissions are 775…
    On old renamed wflogs folders in usage when the site cannot be opened, permissions are 755…
    So, something change permissions but not sure this change prevents something…

    A bit lost I should say…

    Eric

    Changing Firewall back to enabled didn’t change wflogs permissions (still 775).

    About suspected plugins, I am also using Google ReCaptcha by BestWebSoft de-activated yesterday too) that is known to prevent some feature of WordFence. Versions used are all latest.

    Under WordFence diagnostic, I can see FS_CHMOD_DIR that is changing default permissions for a folder to 755…

    I can email diagnostic if useful, let me know the what address to send to…

    Eric

    Diagnostic sent to wftest…

    Eric Collart

    Hi @ecollart,

    It might not only be permissions that change. If the ownership of the folder also changes then permissions going from “775” to “755” would prevent the previous owner, as well as the group, from writing into the folder; same goes for the files.

    In case you’re not familiar with octal permissions, please see this article.

    Could you check the following:

    • owner and group of the wflogs folder when it’s just been created, as well as permissions.
    • owner, group and permissions of the wflogs folder when the issue occurs.

    Please also perform the aforementioned checks for the files within the wflogs folder.

    Hello,

    that’s becoming complicated…

    Using Filezilla:

    owner of folder is different:
    good folder = 25119/25119
    bad folder = 25119/100

    Files permissiosn and ownership are also differents in good and bad folder
    Good folder:
    .htaccess 0664 25119/25119
    attack-data.php 0660 25119/25119
    config.php 0660 25119/25119
    ips.php 0660 25119/25119
    rules.php 0664 25119/25119
    wafRules.rules 0660 25119/25119

    Bad folder:
    .htaccess 0644 25119/100
    attack-data.php 0660 25119/25119
    config.php 0660 25119/25119
    config.tmp.i79Lee 0644 25119/100
    config.tmp.W8Mpal 0644 25119/100
    config.tmp.WoCmA7 0644 25119/100
    ips.php 0660 25119/25119
    rules.php 0664 25119/25119
    wafRules.rules 0660 25119/25119

    config.tmp.x files are 0 byte size.

    Hoping this can help

    Eric Collart

    I must mention that I also have content of a bad folder (renamed while site was blocked) that is exactly similar to the content of actual good foler, being permissions, owner and group !!!!

    So I am not sure we are on the right track….

    Eric Collart

    Hi there

    I have started facing this issue from yesterday.

    When Wordfence activated, whole site is not accessible. It’s giving 504 error.

    deleting wflogs folder doesn’t resolve the issue.

    Have you found any solution ?

    • This reply was modified 2 years, 1 month ago by harish516.
    • This reply was modified 2 years, 1 month ago by harish516.

    Hi @harish516,

    Please start your own topic so we can help you with this issue.

    For me, problem stopped after I remove plugin Feed Them Social recently installed (it worked for several days before causing problem)…
    It runs fine on another WP site but using iTheme instead of WordFence.

    Plugin conflict….

    Eric

Viewing 12 replies - 1 through 12 (of 12 total)
  • The topic ‘WordFence seems blocking my site !’ is closed to new replies.