Wordfence firewall problem

Hello miricaaaaa,
the warnings mean that Wordfence attempted to fetch those files from a remote location and recieved a response code of “200 OK” when it should have recieved a response code of “403 FORBIDDEN”. The access to these files should be determined in your server configuration. Would it be possible for you to ask your web host about this?

I asked them, and they did something. I now had to Configure it again. Should I scan now or what to see if there is the difference?

Yes, sure, go for it!

I have the same issue folowing wordfence irewall update.

Does it mean that we have to modify the permissions to theses files from 777 to 770 or something else ?

Is it enough to do that ?

THX

Hi.

This has also happened to me since I’ve updated today Wordfence and have activated the Firewall

—-
Alert generated at Wednesday 13th of April 2016 at 02:28:06 PM
Warnings:
* Publicly accessible config, backup, or log file found: .user.ini
* Publicly accessible config, backup, or log file found: .htaccess
—-

Any solution?
Thanks! Great job.

I’d also like to know if this means I need to modify the permissions of those particular files, or if it is something I need to request that my host make change. Thanks.

Hello zampai,
In any general case, both “user.ini” and “.htaccess” should have permissions 644. If that doesn’t work it’s best to check with your host what settings they recommend because it may vary depending on server configuration. The main thing to make sure is that those files do not return a “200 OK” response when requested from an external source. You can test this yourself by having a browser console open while attempting to load the url (For example https://mydomain.com/.htaccess). Activate the “Net” panel in the browser console and it will display a 403 Forbidden error in red color if you have set the permissions correctly.

Hi,

I have the same issue, got a warning:
* Publicly accessible config, backup, or log file found: .user.ini

However, I am puzzled because .user.ini is 644 (just like my .htaccess), and also because .user.ini is new to me (WordFence made it???).

In fact, the content of this .user.ini file is only WordFence stuff:
; Wordfence WAF
auto_prepend_file = ‘/home2/aheaom/public_html/wordfence-waf.php’
; END Wordfence WAF

Could you please clarify?? Many thanks!

Since we are seeing so much of it, it’s possible that there is something more to this issue. If either of you who have posted here would allow me to run a very simple test against your server (just attempting to fetch the files), please send an email to [email protected] with the full URL to the location of the files that have been reported to be “publicly accessible”. For example: https://mydomain.com/.htaccess

Thanks in advance!

Dear Wordfence,

I am having the same problem:

Publicly accessible config, backup, or log file found: .user.ini

So, I checked in Cpanel File and see that both my .User.ini and my .Htaccess files both have File Permissions of 644.

Per your/these instructions from your Answer (just above):
“test this yourself by having a browser console open while attempting to load the url (For example https://mydomain.com/.htaccess). Activate the “Net” panel in the browser console”

However, i did Not see the “403 Forbidden error in red color” but instead see a bunch of Files – with the “200 OK” – which you said is Incorrect.

Please Advise on How to Fix this?

In my WordFence Premium – it gives me these two options:

1.
Hide this file in .htaccess

Or

2.
Delete this file (can’t be undone).

Should I do either of these 2 Options or Not?

Thanks,
Sanfordo

Bonsoir, mon anglais est limité. C’est pour ?a, je vous écris en fran?ais et c’est à vous de traduire.

Voici la manipulation à faire :

1/ il faut laisser wordpress et wordfence gérer l’erreur (403 Forbidden) il ne faut pas rediriger sur une page personnalisée à vous.

2/ sur votre (ePanel) il faut désactiver la compression (Gzip) car cela entre en conflit avec (gzinflate():) dans (class-wp-http-encoding.php).

3/ pour la réponse (1/) A mon avis wordfence doit changer de méthode de sorte à ne pas donner la possibilité aux hakers de conna?tre le moindre information sur la configuration, car 644 ou 600 sont aussi des informations qu’il ne faut pas dévulger.
Moi, je préfère la redirection de l’erreur 403 sur l’index de mon site, de sorte à ce que le site soit muet pour toutes les tentatives de bricolage.

En même temps, je demande à wordfence de permettre le choix de la redirection 403 pour éviter la panique des utilisateurs.

I have also had this problem on one of the sites I configured the Wordfence firewall on yesterday. (will now be checking the others and not doing any more configurations!)
Warnings:
* Publicly accessible config, backup, or log file found: .htaccess
Yesterday I updated to latest version of WordPress and configured the Wordfence firewall.
So I am assuming something in the wordfence update/configuration has caused this?

This just started happening to me too. The only thing new that has happened is this 6.1 WF update.

If I enter the site url with the .htaccess, I can read the contents of the .htaccess file instead of getting a 403 error.

Site is self hosted and the permissions are correct, as in never changed and the same as they were.

Should we go back to the earlier version?

My problem is slightly different but seems to stem from the new Wordfence firewall. In my case, installing (or attempting to install) the firewall seems to have broken Bulletproof Security. Five minutes after trying to install the firewall, I refreshed the page as suggested, but received a 500: Internal Server error. After first backing them up, I deleted the .htaccess files in the root folder and subfolder using ftp and upon refreshing the page was able to access wp-admin. But from then on nothing would make Bulletproof work again: I deleted Wordfence and re-uploaded the .htaccess files – another 500 error. I uploaded standard WordPress .htaccess files un-modified by Bulletproof – another 500 error. I deleted Bulletproof, reinstalled Wordfence and managed to install the firewall with standard .htaccess files, but when I tried to reinstall Bulletproof I got another 500 error. I wondered was it an error in Bulletproof, but I updated it on another WordPress installation with no problem. I’m too scared to install the firewall on any of my other sites now, for fear it’ll break Bulletproof. Any suggestions?

enter your ftp www fodler and change permissions of
.user.ini
.htaccess

from 644 to 640

basically remove read from public permissions.

rescan with Wordfence Scan … fixed.

you can check with
https://www.website.com/.user.ini
https://www.website.com/.htaccess

they should both give you error 404.