Wordfence scan dies

The other issue is WordFence keeps reporting the following file has been modified. I click on “view changes” to see the differences and it shows some differences.

But, when I actually download and view the file, the changes Wordfence is reporting aren’t there. I have clicked on ” click here to mark all new issues as fixed” several times.

wp-admin/includes/class-pclzip.php

Is something cached somewhere and/or not being updated by Wordfence?

So now the scan is stuck here and updates with this status message once per hour:

[Oct 10 18:41:55] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2Fmydomain.com&k=removed_by_op&openssl=removed_by_op&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s

Any ideas?

Hi firemyst,
Could you please check “Connectivity” section at (Wordfence > Diagnostics)?
Also, do you have “Start all scans remotely” option enabled at (Wordfence > Diagnostics => Debugging Options)?

P.S. regarding the modified file issue, I think it could be an old scan result because I don’t think you are able to run a new scan by now, right?

Thanks.

• This reply was modified 8 years, 1 month ago by wfalaa.

HI wfalaa!

Thank you for responding!

I enabled “Start all scans remotely”.

under connectivity I, both “Connecting to Wordfence servers (http)” and “Connecting to Wordfence servers (https)” are listed as “ok” with a green checkmark.

I started a new scan after verifying the settings you suggested, and will post the results. I had to kill it again as 8 hours later it seemed like it wasn’t doing anything.

The forums here aren’t letting me post the latest results.

Will try doing it piecemeal.

PART I:
———————————————

[Oct 13 12:06:44] Calling fork() from wordfenceHash::processFile with maxExecTime: 15
[Oct 13 12:06:44] Entered fork()
[Oct 13 12:06:44] Calling startScan(true)
[Oct 13 12:06:44] Got value from wf config maxExecutionTime: 15
[Oct 13 12:06:44] getMaxExecutionTime() returning config value: 15
[Oct 13 12:06:54] Test result of scan start URL fetch: WP_Error::__set_state(array( ‘errors’ => array ( ‘http_request_failed’ => array ( 0 => ‘cURL error 28: Connection timed out after 10001 milliseconds’, ), ), ‘error_data’ => array ( ), ))
[Oct 13 12:06:54] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/%5Bdomain name replaced by op]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=52cc6b074743ca937abf752b
[Oct 13 12:06:57] Scan process ended after forking.
[Oct 13 12:07:05] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_wp_file_content
[Oct 13 12:16:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=resolve_ips
[Oct 13 12:37:34] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 13:42:49] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 14:44:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 15:19:39] Scan kill request received.
[Oct 13 15:25:32] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 15:33:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 15:35:42] Ajax request received to start scan.
[Oct 13 15:35:42] Entering start scan routine
[Oct 13 15:35:42] Got value from wf config maxExecutionTime: 15
[Oct 13 15:35:42] getMaxExecutionTime() returning config value: 15
[Oct 13 15:35:52] Test result of scan start URL fetch: WP_Error::__set_state(array( ‘errors’ => array ( ‘http_request_failed’ => array ( 0 => ‘cURL error 28: Connection timed out after 10001 milliseconds’, ), ), ‘error_data’ => array ( ), ))
[Oct 13 15:35:52] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/%5Bdomain name replaced by op]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&cronKey=17eac56f362b2b822799b43d
[Oct 13 15:35:54] Scan engine received request.
[Oct 13 15:35:54] Checking cronkey
[Oct 13 15:35:54] Fetching stored cronkey for comparison.
[Oct 13 15:35:54] Exploding stored cronkey
[Oct 13 15:35:54] Checking saved cronkey against cronkey param

[Oct 13 15:35:54] Becoming admin for scan
[Oct 13 15:35:54] Scan will run as admin user ‘[id replaced by op]’ with ID ‘1’ sourced from: singlesite get_users() function
[Oct 13 15:35:54] Scan authentication complete.
[Oct 13 15:35:54] Done become admin
[Oct 13 15:35:54] Checking if scan is already running
[Oct 13 15:35:54] Requesting max memory
[Oct 13 15:35:54] Setting up error handling environment
[Oct 13 15:35:54] Setting up scanRunning and starting scan
[Oct 13 15:35:54] Got value from wf config maxExecutionTime: 15
[Oct 13 15:35:54] getMaxExecutionTime() returning config value: 15
[Oct 13 15:35:54] Scan process ended after forking.
[Oct 13 15:36:02] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=scan_heartbleed
[Oct 13 15:36:08] Contacting Wordfence to initiate scan
[Oct 13 15:36:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=log_scan
[Oct 13 15:36:08] Getting plugin list from WordPress
[Oct 13 15:36:08] Found 15 plugins
[Oct 13 15:36:08] Getting theme list from WordPress
[Oct 13 15:36:08] Found 6 themes
[Oct 13 15:36:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_known_files
[Oct 13 15:36:10] Calling Wordfence API v2.23:https://noc1.wordfence.com/malwarePrefixes.bin
[Oct 13 15:36:11] Forking during hash scan to ensure continuity.
[Oct 13 15:36:11] Entered fork()
[Oct 13 15:36:11] Calling startScan(true)

[Oct 13 15:36:11] Got value from wf config maxExecutionTime: 15
[Oct 13 15:36:11] getMaxExecutionTime() returning config value: 15
[Oct 13 15:36:21] Test result of scan start URL fetch: WP_Error::__set_state(array( ‘errors’ => array ( ‘http_request_failed’ => array ( 0 => ‘cURL error 28: Connection timed out after 10001 milliseconds’, ), ), ‘error_data’ => array ( ), ))
[Oct 13 15:36:21] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/%5Bdomain name replaced by op]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=55d9a415735b4bf67e569da0
[Oct 13 15:36:23] Scan process ended after forking.
[Oct 13 15:41:46] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 16:54:34] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 19:09:29] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 21:17:57] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 21:42:44] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 22:44:24] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F%5Bdomain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 23:07:49] Scan kill request received.

[Oct 13 23:08:17] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 23:08:49] Ajax request received to start scan.
[Oct 13 23:08:49] Entering start scan routine
[Oct 13 23:08:49] Got value from wf config maxExecutionTime: 15
[Oct 13 23:08:49] getMaxExecutionTime() returning config value: 15
[Oct 13 23:08:49] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[domain name replaced by op]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&cronKey=[replaced by op]960899
[Oct 13 23:08:51] Scan process ended after forking.
[Oct 13 23:08:53] Scan engine received request.
[Oct 13 23:08:53] Checking cronkey
[Oct 13 23:08:53] Fetching stored cronkey for comparison.
[Oct 13 23:08:53] Exploding stored cronkey
[Oct 13 23:08:53] Checking saved cronkey against cronkey param
[Oct 13 23:08:53] Becoming admin for scan
[Oct 13 23:08:53] Scan will run as admin user '[id replaced by op]' with ID '1' sourced from: singlesite get_users() function
[Oct 13 23:08:53] Scan authentication complete.
[Oct 13 23:08:53] Done become admin
[Oct 13 23:08:53] Checking if scan is already running
[Oct 13 23:08:53] Requesting max memory
[Oct 13 23:08:53] Setting up error handling environment
[Oct 13 23:08:53] Setting up scanRunning and starting scan
[Oct 13 23:08:53] Got value from wf config maxExecutionTime: 15
[Oct 13 23:08:53] getMaxExecutionTime() returning config value: 15

[Oct 13 23:09:01] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=scan_heartbleed
[Oct 13 23:09:07] Contacting Wordfence to initiate scan
[Oct 13 23:09:07] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=log_scan
[Oct 13 23:09:08] Getting plugin list from WordPress
[Oct 13 23:09:08] Found 15 plugins
[Oct 13 23:09:08] Getting theme list from WordPress
[Oct 13 23:09:08] Found 6 themes
[Oct 13 23:09:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_known_files
[Oct 13 23:09:09] Calling Wordfence API v2.23:https://noc1.wordfence.com/malwarePrefixes.bin
[Oct 13 23:09:11] Forking during hash scan to ensure continuity.
[Oct 13 23:09:11] Entered fork()

[Oct 13 23:09:11] Calling startScan(true)
[Oct 13 23:09:11] Got value from wf config maxExecutionTime: 15
[Oct 13 23:09:11] getMaxExecutionTime() returning config value: 15
[Oct 13 23:09:11] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[domain name replaced by op]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=5fef2a101158594227ac9ae1
[Oct 13 23:09:13] Scan process ended after forking.
[Oct 13 23:46:52] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 00:59:05] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 02:03:29] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 02:45:54] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 05:26:35] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 06:01:45] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 07:04:27] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 07:43:45] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[domain name replaced by op]&[first part replaced by op]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[replaced by op]ec0c9c80da1bc20654997e2a&openssl=[replaced by op]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 08:07:04] Scan kill request received.

Hi Wfalaa!

THANK YOU so much for replying.

Under Connectivity for both:
Connecting to Wordfence servers (http)
Connecting to Wordfence servers (https)
it is listed as “ok” with a green checkmark.

I also checked the option “Start all scans remotely”.

I reran the scan, and had to kill it again.

Here’s the results from the last several lines (I replaced some information):

[Oct 13 12:06:44] Calling fork() from wordfenceHash::processFile with maxExecTime: 15
[Oct 13 12:06:44] Entered fork()
[Oct 13 12:06:44] Calling startScan(true)
[Oct 13 12:06:44] Got value from wf config maxExecutionTime: 15
[Oct 13 12:06:44] getMaxExecutionTime() returning config value: 15
[Oct 13 12:06:54] Test result of scan start URL fetch: WP_Error::__set_state(array( 'errors' => array ( 'http_request_failed' => array ( 0 => 'cURL error 28: Connection timed out after 10001 milliseconds', ), ), 'error_data' => array ( ), ))
[Oct 13 12:06:54] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[<domain name replaced by op>]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=52cc6b074743ca937abf752b
[Oct 13 12:06:57] Scan process ended after forking.
[Oct 13 12:07:05] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_wp_file_content
[Oct 13 12:16:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=resolve_ips
[Oct 13 12:37:34] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 13:42:49] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 14:44:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 15:19:39] Scan kill request received.
[Oct 13 15:25:32] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 15:33:22] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 15:35:42] Ajax request received to start scan.
[Oct 13 15:35:42] Entering start scan routine
[Oct 13 15:35:42] Got value from wf config maxExecutionTime: 15
[Oct 13 15:35:42] getMaxExecutionTime() returning config value: 15
[Oct 13 15:35:52] Test result of scan start URL fetch: WP_Error::__set_state(array( 'errors' => array ( 'http_request_failed' => array ( 0 => 'cURL error 28: Connection timed out after 10001 milliseconds', ), ), 'error_data' => array ( ), ))
[Oct 13 15:35:52] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[<domain name replaced by op>]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&cronKey=17eac56f362b2b822799b43d
[Oct 13 15:35:54] Scan engine received request.
[Oct 13 15:35:54] Checking cronkey
[Oct 13 15:35:54] Fetching stored cronkey for comparison.
[Oct 13 15:35:54] Exploding stored cronkey
[Oct 13 15:35:54] Checking saved cronkey against cronkey param
[Oct 13 15:35:54] Becoming admin for scan
[Oct 13 15:35:54] Scan will run as admin user '[<id replaced by op>]' with ID '1' sourced from: singlesite get_users() function
[Oct 13 15:35:54] Scan authentication complete.
[Oct 13 15:35:54] Done become admin
[Oct 13 15:35:54] Checking if scan is already running
[Oct 13 15:35:54] Requesting max memory
[Oct 13 15:35:54] Setting up error handling environment
[Oct 13 15:35:54] Setting up scanRunning and starting scan
[Oct 13 15:35:54] Got value from wf config maxExecutionTime: 15
[Oct 13 15:35:54] getMaxExecutionTime() returning config value: 15
[Oct 13 15:35:54] Scan process ended after forking.
[Oct 13 15:36:02] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=scan_heartbleed
[Oct 13 15:36:08] Contacting Wordfence to initiate scan
[Oct 13 15:36:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=log_scan
[Oct 13 15:36:08] Getting plugin list from WordPress
[Oct 13 15:36:08] Found 15 plugins
[Oct 13 15:36:08] Getting theme list from WordPress
[Oct 13 15:36:08] Found 6 themes
[Oct 13 15:36:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_known_files
[Oct 13 15:36:10] Calling Wordfence API v2.23:https://noc1.wordfence.com/malwarePrefixes.bin
[Oct 13 15:36:11] Forking during hash scan to ensure continuity.
[Oct 13 15:36:11] Entered fork()
[Oct 13 15:36:11] Calling startScan(true)
[Oct 13 15:36:11] Got value from wf config maxExecutionTime: 15
[Oct 13 15:36:11] getMaxExecutionTime() returning config value: 15
[Oct 13 15:36:21] Test result of scan start URL fetch: WP_Error::__set_state(array( 'errors' => array ( 'http_request_failed' => array ( 0 => 'cURL error 28: Connection timed out after 10001 milliseconds', ), ), 'error_data' => array ( ), ))
[Oct 13 15:36:21] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[<domain name replaced by op>]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=55d9a415735b4bf67e569da0
[Oct 13 15:36:23] Scan process ended after forking.
[Oct 13 15:41:46] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 16:54:34] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 19:09:29] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 21:17:57] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 21:42:44] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 22:44:24] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 13 23:07:49] Scan kill request received.
[Oct 13 23:08:17] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 13 23:08:49] Ajax request received to start scan.
[Oct 13 23:08:49] Entering start scan routine
[Oct 13 23:08:49] Got value from wf config maxExecutionTime: 15
[Oct 13 23:08:49] getMaxExecutionTime() returning config value: 15
[Oct 13 23:08:49] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[<domain name replaced by op>]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&cronKey=[<replaced by op>]960899
[Oct 13 23:08:51] Scan process ended after forking.
[Oct 13 23:08:53] Scan engine received request.
[Oct 13 23:08:53] Checking cronkey
[Oct 13 23:08:53] Fetching stored cronkey for comparison.
[Oct 13 23:08:53] Exploding stored cronkey
[Oct 13 23:08:53] Checking saved cronkey against cronkey param
[Oct 13 23:08:53] Becoming admin for scan
[Oct 13 23:08:53] Scan will run as admin user '[<id replaced by op>]' with ID '1' sourced from: singlesite get_users() function
[Oct 13 23:08:53] Scan authentication complete.
[Oct 13 23:08:53] Done become admin
[Oct 13 23:08:53] Checking if scan is already running
[Oct 13 23:08:53] Requesting max memory
[Oct 13 23:08:53] Setting up error handling environment
[Oct 13 23:08:53] Setting up scanRunning and starting scan
[Oct 13 23:08:53] Got value from wf config maxExecutionTime: 15
[Oct 13 23:08:53] getMaxExecutionTime() returning config value: 15
[Oct 13 23:09:01] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=scan_heartbleed
[Oct 13 23:09:07] Contacting Wordfence to initiate scan
[Oct 13 23:09:07] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=log_scan
[Oct 13 23:09:08] Getting plugin list from WordPress
[Oct 13 23:09:08] Found 15 plugins
[Oct 13 23:09:08] Getting theme list from WordPress
[Oct 13 23:09:08] Found 6 themes
[Oct 13 23:09:08] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_known_files
[Oct 13 23:09:09] Calling Wordfence API v2.23:https://noc1.wordfence.com/malwarePrefixes.bin
[Oct 13 23:09:11] Forking during hash scan to ensure continuity.
[Oct 13 23:09:11] Entered fork()
[Oct 13 23:09:11] Calling startScan(true)
[Oct 13 23:09:11] Got value from wf config maxExecutionTime: 15
[Oct 13 23:09:11] getMaxExecutionTime() returning config value: 15
[Oct 13 23:09:11] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/[<domain name replaced by op>]/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&cronKey=5fef2a101158594227ac9ae1
[Oct 13 23:09:13] Scan process ended after forking.
[Oct 13 23:46:52] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 00:59:05] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 02:03:29] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 02:45:54] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 05:26:35] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 06:01:45] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 07:04:27] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 07:43:45] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[<domain name replaced by op>]&[<first part replaced by op>]faec0238b54e6933cb2b2ca8ad92ff6a9aeb[<replaced by op>]ec0c9c80da1bc20654997e2a&openssl=[<replaced by op>]647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 08:07:04] Scan kill request received.

As you can see from the timestamps, I had to kill the request as it seem to keep running without any results or any good error information.

Any ideas?

Is there a bug in WordFence?

I killed the job at 08:07:04, but as you can see from the output it’s still running hours later?!
————————————–

[Oct 14 08:07:04] Scan kill request received.
[Oct 14 09:04:30] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[my domain]&k=[replaced by op]c5357a7c7ec0c9c80da1bc20654997e2a&openssl=268439647&phpv=5.6.26&betaFeed=0&cacheType=0&action=ping_api_key
[Oct 14 09:04:30] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[my domain]&k=[replaced by op]c5357a7c7ec0c9c80da1bc20654997e2a&openssl=268439647&phpv=5.6.26&betaFeed=0&cacheType=0&action=get_known_vuln_pattern
[Oct 14 10:55:13] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[my domain]&k=[replaced by op]c5357a7c7ec0c9c80da1bc20654997e2a&openssl=268439647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 12:00:20] Calling Wordfence API v2.23:https://noc1.wordfence.com/v2.23/?v=4.6.1&s=http%3A%2F%2F[my domain]&k=[replaced by op]c5357a7c7ec0c9c80da1bc20654997e2a&openssl=268439647&phpv=5.6.26&betaFeed=0&cacheType=0&action=send_net_404s
[Oct 14 13:22:40] Scheduled time for day 0 hour 0 is: Saturday 15th of October 2016 04:49:31 PM
[Oct 14 13:22:40] Scheduled time for day 1 hour 0 is: Sunday 16th of October 2016 04:01:50 PM
[Oct 14 13:22:40] Scheduled time for day 2 hour 0 is: Monday 17th of October 2016 04:42:17 PM
[Oct 14 13:22:40] Scheduled time for day 3 hour 0 is: Tuesday 18th of October 2016 04:19:38 PM
[Oct 14 13:22:40] Scheduled time for day 4 hour 0 is: Wednesday 19th of October 2016 04:06:24 PM
[Oct 14 13:22:40] Scheduled time for day 5 hour 0 is: Thursday 20th of October 2016 04:25:34 PM
[Oct 14 13:22:40] Scheduled time for day 6 hour 0 is: Friday 14th of October 2016 04:54:02 PM

Hi firemyst,
Thanks for sharing this information with us, one important thing to note when it comes to pasting long text (from log files, reports, etc…) is to use Pastbin website, then share the link here in the forum, this would be very helpful and appreciated.

From what you’ve shared, I can tell this issue is related to a connection timeout while using cURL: cURL error 28: Connection timed out after 10001 milliseconds, so you will need to report this one to your web host, hopefully they should be able to sort it out for you.

Another thing which may help us to narrow dawn the cause of this issue is to hit this URL in your browser your-website.com/wp-admin/admin-ajax.php and let me know what you will get.

Thanks.

Thank you for your responses.

I did the following as requested:

Another thing which may help us to narrow dawn the cause of this issue is to hit this URL in your browser your-website.com/wp-admin/admin-ajax.php and let me know what you will get.

0

(zero)

Thoughts?

Here’s an updated scan from another WordPress site that’s still going if you wanted to check your servers.

Even if there’s timeouts, scans shouldn’t take this long. There’s currently approximately 50 blog posts, about 15 plugins (of which 2 aren’t activated), and a free theme installed.

Pastebin link (thank you for the suggestion!) :
https://pastebin.com/wFaa3Y45

Any ideas?