Cannot activate (“optimize”) Wordfence Firewall with php-fpm/FastCGI enabled

Hi @caseybea, I’m glad that works for you.

I was going to advise that .user.ini could be placed directly in WordPress folders but was probably going to be difficult to manage long-term with version updates and possibly needing to be in multiple folders, not just one.

The soft link idea sounds good if that has had the desired effect. We are seeing more requests around php-fpm/FastCGI so will look further into that method when advising for a setup with advanced/extra requirements such as this.

Thanks again,

Peter.

Well the soft link works better than actual files because then if the firewall needs to be disabled it works.

Is putting it just in wp-admin enough to ensure the firewall is always working?

Of course the long-term solution is using the CONTEXT root not document root. But you said we can’t do that until PHP8. Oy.

Hi @caseybea,

If there was a copy of .user.ini in wp-admin/, that one would be loaded during the AJAX hits. However, it’s not a full solution as every directory on the site would need its own .user.ini.

Thanks,

Peter.

Then it appears my setup– (apache home not the same as wordpress home, which is a perfectly valid setup), and php-fpm is unusable. Wow.

With plugins and themes and such, there’s almost a thousand dirfectories.

I may have to go ahead and force this in php.ini but that makes me super unhappy.

Because with that, the firewall now cannot be “managed” (enabled, disabled) without stopping php and disabling it in php.ini and restarting everything.

And I also do not know what the effect of having that auto_prepend in php.ini will have on OTHER php code (non-wordpress) that our site serves up.

I wonder, with all the complexities that php-fpm introduces, if wordfence can’t manage this some other way in the future. This was all a non-problem and all worked perfectly when using the older apache php handler. But php-fpm is a bit more tricky…..!

Hi @caseybea,

One last thing that might help for your concern about the effect of auto_prepend_file on other non-WordPress code can be set in php.ini. Check under “Using a single php.ini on servers with multiple sites” on this help page:

https://www.wordfence.com/help/firewall/optimizing-the-firewall/troubleshooting/#using-a-single-php-ini-on-servers-with-multiple-sites

You could use something like the example on there, to apply the auto_prepend_file only when in the directory where WP is installed:

[PATH=/path/to/site/]
auto_prepend_file = '/path/to/site/wordfence-waf.php'

This has to be at the end of the php.ini, so the path doesn’t apply to the other settings throughout the file. This should work in CGI and FCGI, and has applied to subdirectories in our test environment, but as your setup has been fairly unique, we can’t say with absolute certainty it’ll work in your environment.

Thanks,

Peter.