yorman
Forum Replies Created
-
How many files are being mentioned in the mail alerts?
Is it the same files mentioned in this other ticket [1]?
The website must be accessible through the Internet, it cannot be a localhost.
@harzens — thank you for the screenshot and the explanation.
I will work on this now and try to get a patch for the end of the day.
Thank you for your patience.
@harzens — the code that sends the email notifications uses the same code that prints the data into the plugin’s dashboard, so it is a mystery to me how can you receive email notifications about these files but cannot see them in the dashboard.
@ale5000 — I understand your idea now, I will see what can be done, thank you.
I will mark as non-resolved for now while I investigate.
Those are Italian language files, they are not part of the official WordPress package, they were downloaded by the system when you went to the settings page and changed the language of your website, but they are not part of the official installation, that’s why the plugin is flagging them.
Please fix
This is not a bug, it’s a feature request.
You can select these files and choose the option “Mark As Fixed” which will do exactly what you are suggesting, but only in your own website. Other people will prefer to keep receiving these notifications, so implementing your suggestion in the code is a bad idea. The option to mark a file as “fixed” was designed specifically for edge cases like yours, where the website owner believes that the flagged files are harmless, and so they can force the plugin to ignore them in future scans.
Marking as resolved, feel free to re-open if you need more information.
Yes, they [SiteCheck] should check it in lowercase too.
I will pass this to my co-workers, they are the ones who maintain that service.
Thank you.
The “in x hours” means that the timestamp that was stored in the logs is in the future compared to the current timestamp reported by the web server. This only happens if the timezone of the server is different than the timezone that was being used when the logs were written into disk.
For example, lets say that yesterday the server had timezone UTC-0000 and the plugin registered six logs at 1, 2, 3, 4, 5, 6:00 pm but today someone changed the timezone of the server to UTC-0700 which makes the values in the log file appear as if they were in the future because UTC-07 is on the left of UTC-00.
Ask your hosting provider to see if they changed something since yesterday.
Since we haven’t released a new version during this week, it is safe to assume that this is not a problem with the plugin’s code but with the server environment. Taking a wild guess, I would say that your server was updated and the timezone changed.
Go to the plugin’ settings page, at the bottom of the “General” section you will find a panel called “Timezone”; configure this option according to the information provided by your own web server.
Marking as resolved, feel free to re-open if you need more information.
The Sucuri plugin only opens the main access control file (the one in the document root) for reading, never for writing. The only files that it opens for writing are these [1][2][3] and only when you go to the plugin’ settings page, Hardening section, and click one of the buttons to block the direct access to the PHP files, it doesn’t modifies these files automatically, only per request when you click a button.
You said this is a recurrent problem, if I was you I would disable/delete the Sucuri plugin for 1-2 days and see if the problem keeps happening, if yes then you will be sure that the culprit is one of the other plugins, if the problem stops then I guess you could blame the Sucuri plugin, if this is the case, please contact me again so I can continue the investigation.
Marking as resolved for now, feel free to re-open if you need more information.
[1]
/wp-content/.htaccess
[2]/wp-includes/.htaccess
[3]/wp-content/uploads/.htaccessThe plugin caches this information for a couple of minutes (20 minutes in the latest version) and SiteCheck for 48 hours. Assuming that you are seeing these recommendations even after the cache has been flushed, I would say the headers were either implemented incorrectly or your hosting provider has disabled the mod_headers module, at least outside the virtual host.
However, if you are completely sure that the headers are being applied correctly, just send me an email to
[removed](email removed to avoid spam) with the URL to the websites that you are having problems with and I will check them manually to see what is the problem.Marking as resolved, as this is an edge case that is only affecting one user. I will continue handling this ticket in private with the original poster via emails. If anyone else is having the same problems feel free to jump into the conversation and I will help.
Some plugins and themes use the posts table to temporarily store data, it is possible that “WPForms Lite” does that too and somehow they were able to trigger that action, for example, submitting information through a form that you created using that plugin. The plugin stored the data that they submitted in the database, and this triggered the creation of a new post, which also triggered the event report from the Sucuri plugin, and so you received a notification about that.
It doesn’t mean that you were hacked, but considering the reputation of that IP address, I would say that they are using a web vulnerability scanner against your website to detect possible security holes that can be used to exploit and get inside the admin area. These vulnerability scanners usually submit random information through every form found in any page, just to see how it behaves; I believe this is what happened in your case.
Marking as resolved, feel free to re-open if you need more information.
You can contact your hosting provider to ask them to whitelist the
execPHP function, but I don’t think they will accept your request unless you can justify the purpose of that action.These “shell functions” can open a security hole in a web server if you don’t know how to use them. That’s why many hosting providers keep them disabled. And that’s why this “diff utility” is also disabled by default, only advanced users are supposed to know what it is and will know the risks of having that function enabled.
Now that you have provided more details, like the name of the file that is being flagged, I can tell you with certainty that there is a piece of code running in your website that is generating either one or more warnings/errors, PHP automatically stores these things in files called
error_log; they are not part of a normal WordPress installation, that’s why the Sucuri plugin is flagging them.A temporary solution would be to select these files and delete them, from the same WordPress Integrity interface, however, the plugin or theme that is generating the warnings/errors will keep generating them until you fix the code or until you ask their original author to fix them, and while this happens, PHP will keep storing those warnings/errors into that
error_logfile and the Sucuri plugin will keep flagging them.If you open that file — the “error_log” file — in a code editor, you will see a reference to the files that are generating the warnings/errors and then take a decision of who to contact to fix them. It could be a plugin or theme, only you can determine that as you are the administrator of the website.
You cannot (or should not) create an administrator account for me, that implies that I will work in your website as if you were a paying customer, but because you are not this creates liability. If I break something, there is nothing that can protect you because there is not an official contract between you and me, if you were a paying customer the company — Sucuri Inc. in this case — would cover the damage in case it happens.
Then you cannot whitelist your IP address.
That website that you linked in your original post is being protected by the Sucuri Firewall, one of our customers created an account and added the website there, and one can only do that if the person also has administrative access to the website. If you don’t have access to the Sucuri Firewall then you have to ask the person who has control over the account to whitelist your IP.
EDIT: Taking a quick look at the screenshot [1] that you provided, it seems that you are trying to use a backdoor to delete some content from the website, that’s why the Sucuri Firewall blocked your IP address.
[1] https://image.prntscr.com/image/l1UK22bKSqupz-SzHlLw5g.png
It’s impossible for me to tell you why those files are modified. I don’t have access to your website, so I cannot inspect the files to tell you what are the modifications about, you have to do it by yourself.
I can only tell you that the plugin was able to detect the differences because the checksum of each file differs from the checksum of the original WordPress files. Maybe you have an installation in a different language, this usually triggers the generation of additional language files that are outside the official WordPress package, and so they are considered orphan files, and the plugin flags them.
I usually recommend people to enable the “WordPress Integrity Diff Utility” from the plugin’ settings page, so they can see what are the differences in these files. But in your case I cannot recommend you that because in your other ticket [1] you mentioned that you are seeing an error that indicates that your hosting provider blocked the tool that is required in order to execute the diff utility. You will have to check the content of those files by hand.
Marking as resolved, feel free to re-open if you need more information.
[1] https://wordpress.org/support/topic/wordpress-integrity-diff-utility/
can you tell me its ok disabled wordpress integrity diff utility?
Yes, it is okay to have this option disabled, if you don’t want to use it.
[…] or i must enabled this feature
You can enable this option if you think the tool will help you investigate the corruption of the WordPress core files.
i dont have any idea about it
The diff utility is a tool that allows you to see the differences between the code that you have installed in your website and the code that was originally provided by WordPress, you can see an example here [1]. However, to be able to enable this option your server needs to enable something called “shell function” and apparently your hosting provider blocked that, that’s why you are seeing that error message. So even if you wanted to enable that option, you cannot, because your hosting provider blocked the “shell functions”.
Marking as resolved, feel free to re-open if you need more information.
