{"id":19014157,"date":"2026-09-08T08:16:07","date_gmt":"2026-09-08T08:16:07","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/urgent-cleantalk-surface-php-timeouts-causing-customer-facing-http-500-errors\/"},"modified":"2026-09-09T10:57:12","modified_gmt":"2026-09-09T10:57:12","slug":"urgent-cleantalk-surface-php-timeouts-causing-customer-facing-http-500-errors","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/urgent-cleantalk-surface-php-timeouts-causing-customer-facing-http-500-errors\/","title":{"rendered":"CleanTalk Surface.php timeouts causing customer-facing HTTP 500 errors"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hello CleanTalk Support,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">we have identified a serious issue with <strong>Security by CleanTalk 2.186<\/strong> on our production WooCommerce store.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since <strong>August 31, 2026<\/strong>, our WooCommerce fatal error logs contain thousands of recurring identical errors:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Maximum execution time of 120 seconds exceeded<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">File:<code>wp-content\/plugins\/security-malware-firewall\/lib\/CleantalkSP\/SpbctWP\/Scanner\/Surface.php<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Line:<code>463<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The errors have continued continuously since August 31, usually around <strong>1,500 times per day<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We initially thought these might only be internal scanner\/background errors. However, we have now correlated the CleanTalk fatal-error log with our Apache access log for <strong>September 7<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On September 7:<\/p>\n\n\n\n<ul>\n<li><strong>1,365 HTTP requests returned status 500<\/strong><\/li>\n\n\n\n<li><strong>1,326 of those HTTP 500 requests ran for approximately 122\u2013129 seconds before failing<\/strong><\/li>\n\n\n\n<li><strong>1,234 of these long-running HTTP 500 requests terminate at the same second, or within \u00b11 second, as one of the recurring CleanTalk <code>Surface.php:463<\/code> timeout fatals<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are <strong>not limited to background\/scanner endpoints<\/strong>. The affected requests include normal public WooCommerce\/frontend traffic such as:<\/p>\n\n\n\n<ul>\n<li>product pages<\/li>\n\n\n\n<li>cart<\/li>\n\n\n\n<li>checkout<\/li>\n\n\n\n<li>order-received \/ order-pay<\/li>\n\n\n\n<li>My Account<\/li>\n\n\n\n<li>WordPress REST requests<\/li>\n\n\n\n<li>admin-ajax requests<\/li>\n\n\n\n<li>normal landing pages<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We therefore have strong evidence that the CleanTalk issue is currently causing <strong>real customer-facing HTTP 500 responses<\/strong>, not merely filling the error log.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This morning, September 8, a customer also reported receiving WordPress&#8217; generic <strong>\u201cThere has been a critical error on this website\u201d<\/strong> message immediately after successfully paying via Amazon Pay at approximately 06:29 local time. The payment itself was completed successfully. Multiple identical CleanTalk <code>Surface.php<\/code> timeout fatals occurred around that time as well.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We cannot yet correlate that particular request with today&#8217;s Apache access log because our hosting provider only makes the daily access log available after the day has ended. Therefore we are <strong>not claiming yet that CleanTalk caused this specific Amazon Pay incident<\/strong>, but it is consistent with the customer-facing HTTP 500 pattern we have already confirmed for September 7.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The plugin currently shows the last completed malware scan as <strong>August 30<\/strong>, although these <code>Surface.php<\/code> errors started on August 31 and have continued around the clock since then.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can see that <strong>Security by CleanTalk 2.187<\/strong> is available. However, this is a high-traffic production WooCommerce store, and we do not want to perform an unverified security-plugin update or disable the firewall without knowing that it addresses the actual problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Could you please urgently confirm:<\/p>\n\n\n\n<ol>\n<li>Is this exact <code>Scanner\/Surface.php:463 \u2013 Maximum execution time of 120 seconds exceeded<\/code> issue known in version 2.186?<\/li>\n\n\n\n<li><strong>Does version 2.187 specifically fix this exact issue?<\/strong><\/li>\n\n\n\n<li>If yes, which fix\/change in 2.187 addresses it?<\/li>\n\n\n\n<li>Why is <code>Scanner\/Surface.php<\/code> apparently being invoked continuously even though the last malware scan shown in the plugin completed on August 30?<\/li>\n\n\n\n<li><strong>Is there a safe temporary way to stop only the affected Scanner\/Surface process while keeping Security Firewall and WAF fully active?<\/strong><\/li>\n\n\n\n<li>Is it safe to leave the current situation running, considering that we have confirmed customer-facing requests ending in HTTP 500 after approximately 120 seconds?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">We can provide the WooCommerce fatal-error logs and the Apache access log privately if you need them for investigation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because this is now demonstrably affecting production HTTP requests, we would appreciate an urgent technical response rather than a general recommendation to update to the latest version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thank you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Best regards<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monika<\/p>\n","protected":false},"template":"","class_list":["post-19014157","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19014157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19014157\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19014157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}