WordFence seems blocking my site !

Hi @ecollart,

This is most likely due to the fact that permissions on the wflogs folder or on some of the files it contains, are being changed after it is created (or restored) most likely by a cron job (hence the regularity) –by the way, you can simply delete the wflogs folder and let it be recreated (which will happen as soon as there is a new visit on your site).

Do you notice a change of ownership/permissions on the wflogs folder itself and/or the files it contains before you delete/restore it and after it’s recreated/restored?
Note that you will need to go in and set the Firewall back to “Enabled and protecting” as it will default to “Learning mode” when you delete the wflogs folder.

Also could you please confirm which hosting provider you’re using?

• This reply was modified 7 years, 3 months ago by wfyann. Reason: Additional info

I will do that test on permission but I have strong suspicion on plugin Mailpoet 3 as site is up since yesterday when I de-activated that plugin…
I used Maipoet 2 previously and never had any hickup…

Provider is Nuxit.
My site was moved to a new platform for lazy mail problem, accumulation of cron jobs and some SSL related problem (TLS 1.2) with PDF & Print by BestWebSoft plugin; those problems are solved.

Thanks a lot for your support, I’ll post results soon…

Eric Collart

Mailpoet 3 is just a suspicion, could also be the provider’s new platform and/or what happends on new visit (about no traffic on that site as it is a test one.

Eric

Hello,

Actually my site is working fine, permissions on wflogs foler are 755.
if I delete wflogs folder and let it recreated by WordFence at first visit, permissions are 775…
On old renamed wflogs folders in usage when the site cannot be opened, permissions are 755…
So, something change permissions but not sure this change prevents something…

A bit lost I should say…

Eric

Changing Firewall back to enabled didn’t change wflogs permissions (still 775).

About suspected plugins, I am also using Google ReCaptcha by BestWebSoft de-activated yesterday too) that is known to prevent some feature of WordFence. Versions used are all latest.

Under WordFence diagnostic, I can see FS_CHMOD_DIR that is changing default permissions for a folder to 755…

I can email diagnostic if useful, let me know the what address to send to…

Eric

Diagnostic sent to wftest…

Eric Collart

Hi @ecollart,

It might not only be permissions that change. If the ownership of the folder also changes then permissions going from “775” to “755” would prevent the previous owner, as well as the group, from writing into the folder; same goes for the files.

In case you’re not familiar with octal permissions, please see this article.

Could you check the following:

• owner and group of the wflogs folder when it’s just been created, as well as permissions.
• owner, group and permissions of the wflogs folder when the issue occurs.

Please also perform the aforementioned checks for the files within the wflogs folder.

Hello,

that’s becoming complicated…

Using Filezilla:

owner of folder is different:
good folder = 25119/25119
bad folder = 25119/100

Files permissiosn and ownership are also differents in good and bad folder
Good folder:
.htaccess 0664 25119/25119
attack-data.php 0660 25119/25119
config.php 0660 25119/25119
ips.php 0660 25119/25119
rules.php 0664 25119/25119
wafRules.rules 0660 25119/25119

Bad folder:
.htaccess 0644 25119/100
attack-data.php 0660 25119/25119
config.php 0660 25119/25119
config.tmp.i79Lee 0644 25119/100
config.tmp.W8Mpal 0644 25119/100
config.tmp.WoCmA7 0644 25119/100
ips.php 0660 25119/25119
rules.php 0664 25119/25119
wafRules.rules 0660 25119/25119

config.tmp.x files are 0 byte size.

Hoping this can help

Eric Collart

I must mention that I also have content of a bad folder (renamed while site was blocked) that is exactly similar to the content of actual good foler, being permissions, owner and group !!!!

So I am not sure we are on the right track….

Eric Collart

Hi there

I have started facing this issue from yesterday.

When Wordfence activated, whole site is not accessible. It’s giving 504 error.

deleting wflogs folder doesn’t resolve the issue.

Have you found any solution ?

• This reply was modified 7 years, 1 month ago by harish516.
• This reply was modified 7 years, 1 month ago by harish516.

Hi @harish516,

Please start your own topic so we can help you with this issue.

For me, problem stopped after I remove plugin Feed Them Social recently installed (it worked for several days before causing problem)…
It runs fine on another WP site but using iTheme instead of WordFence.

Plugin conflict….

Eric