wfasa

Hi @leonsky999,
There are some .tmp files in the wflogs folder you sent in. My best guess is that your site had problems writing to the file system at some point which caused the files in wflogs to become corrupt. Hopefully this was a one time occurrence.

Hi again @essep,
It does sound like this is probably an issue with server side cache then. I do recall we saw something similar with Cloudflares Rocket loader at some point where it would cache WordPress admin pages. That issue should have been resolved a long time ago though.

If you can see the file via FTP but it’s not loading in a browser, your host should hopefully be able to explain why though. Fingers crossed!

Hi again @amazinggracepublishing,
It sounds like someone may have NAMED their malware after Wordfence? As I said before the Wordfence plugin itself is hosted here on WordPress.org and does not contain viruses (as anyone would be able to check for themselves, since the code is openly available).

I am not aware of any emails we’ve received from you. To which email address did you send them?

Hi again!
Okay, is there any chance there could be an old composer library loading something independent of WordPress plugins? For a custom app? Or something that was part of installation package on these sites?

Hi @mish99,
Please check to make sure

1. You have enabled email alerts for both critical alerts and warnings.
2. You have the scan option called “Updates Needed (Plugin, Theme, or Core)” enabled

If you think something may have happened during the upgrade to Multisite, completely removing Wordfence (including removing database tables) might be an option. To do this you can simply enable the Wordfence option “Delete Wordfence tables and data on deactivation” and then deactivate and reactivate Wordfence.

Hi @alcat,
The file isn’t supposed to be there but I’m not sure why you weren’t warned about it before. If you’ve changed some Wordfence options recently, that could be the cause? Perhaps the corresponding Wordfence option wasn’t enabled?

I would recommend you review the contents of the file to determine whether it’s malicious or not.

Hi @jordh,
These are the places the URL could be coming from

– Database wp_options table (site url/home url)
– wp-config.php constants
– Wordfence also stores it’s own copy. Perhaps that’s not being updated? If so you’d find it in a table called wfConfig in the row wp_home_url

If it’s neither of those, it would have to be another plugin. Hope that helps!

Hi @mabuhsk,
We resolve threads after a few weeks so we can keep track of where we still have work left to do. We can not help you anymore with this specific issue so opening a new thread will not help. When we’re privacy shield certified, we will let you know via our usual channels (Blog, Twitter, and possibly notice in the Wordfence plugin).