Yes, rules.php is 0kb in size. wflogs/ is 755 and owned by www-data. wp-content/ is 775 and not owned by www-data. Does wp-content/ matter or just wpflogs/?
Not sure if this is related but in Tool -> Diagnostics -> Connectivity there’s this message – Connecting back to this site
wp_remote_post() test back to this server failed! Response was: cURL error 60: SSL certificate problem: certificate has expired
I’m using Cloudflare on this domain.