The function you want to use does not work, as auto_prepend_file is not available in our environment.
Wordfence can be used, only the function which uses auto_prepend_file cannot be used.

Is there any other way to make auto_prepend_file work properly?

However, I now find it is not being included.

I also cannot find any option in the settings to let it be included, or specify it.

How can I include my own auto_prepend_file as well as yours?

# BEGIN NinjaFirewall
<IfModule Litespeed>
   php_value auto_prepend_file "/var/www/vhosts/XXX.de/YYY.de/wp-content/nfwlog/ninjafirewall.php"
</IfModule>
# END NinjaFirewall

It shows following message:
Oops! Full WAF mode is not enabled yet.
Make sure your HTTP server support the php_value auto_prepend_file directive in .htaccess files. Maybe you need to restart your HTTP server to apply the change, or simply to wait a few seconds and reload this page?

I waited and reloaded, even restarted the server but NF is still in WordPress WAF mode.
I tried all setup methods. But NF still shows me WP WAF mode.

I checked whether my server configuration supports the php_value auto_prepend_file directive in .htaccess files and I think it should, because I checked in the phpinfo-file and there is an entry in line “auto_prepend_file” with the correct path.

I switched back to Apache only and NinjaFirewall is showing me Full WAF mode. Switching again to LS is staying in WP WAF mode.

I could provide you both phpinfo-files from Apache only and LiteSpeed if it could help?
Can you help me finding out the problem? Maybe it’s even a bug in NinjaFirewall, or why is phpinfo showing me that the ninjafirewall.php is auto_prepend_file?

Thanks for your help!

PHP setting called auto_prepend_file is currently in use and is including the following file, which I do not recognize:

/home/406838.cloudwaysapps.com/bjqjaqjgkp/public_html/malcare-waf.php

Please advise,

V

I’m at this page about the Siteground WAF installation.

In there it says:

Go to your site’s cPanel, and click the PHP Variables Manager icon

Click the link that says “public_html”

Enter “auto_prepend_file” as the variable name, click the “Add” button, and then enter the path to wordfence-waf.php

Turn on the checkbox “Apply changes to all sub-directories” and click Save.

The thing is this: I have a primary domain (which its folder is the public_html), and in the public_html is the rest of the domains (folders); one of them is afrasin.org.

When it says “Turn on the checkbox “Apply changes to all sub-directories”” it makes me stop and think, why would I apply changes to all sub-directories in the public_html when I have all domains in there?

This means that it would apply auto_prepend_file = ‘/home/hotelesm/public_html/afrasin.org/wordfence-waf.php’ to all my other domains (site | because they are the sub-directories of the public_html).

Wouldn’t not be the right thing to do, to put that auto_prepend_file in the afrasin.org folder and Apply to all its sub-directories?

To make your site as secure as possible, the Wordfence Web Application Firewall is designed to run via a PHP setting called auto_prepend_file, which ensures it runs before any potentially vulnerable code runs. This PHP setting is currently in use, and is including this file:
/home/customer/www/staging2.josteltd.com/public_html/wordfence-waf.php.
This is pointing to the staging site.
I deleted wordfence plugin and reinstalled but same message.

How can I correct this? Thanks

The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page

So looking for the issue, I’ve found a previous your support around the same question

So, looking into “Other Tests section” and again “Click to view your system’s configuration in a new window“ I can see that for the first one domain the variable “auto_prepend_file” is correctly valorized, but for the second one domain the same variable isn’t valorized, simply blank the value.

What could meant this behavior?
And eventually could be depend from a Wordfence bug or a misconfigured web server setup?

Many thanks!

I have a problem: NinjaFirewall does not want to work in FullWAF mode. Writes that “php_value auto_prepend_file” is not supported by the server, although this is not so.

I have a dozen sites on the same hosting as this site and everything works.

Here are screenshots of the admin-panel and Ninja troubleshooter

• screen wp-admin — https://img.artc.at/scrn/1564784656088.png
• screen Ninja troubleshooter — https://img.artc.at/scrn/1564784050716.png