Enabling Falcon Causes 500 Server Error

Thanks for the detailed report — I don’t know of any issues with the plugins or theme you have, but I’m also not familiar with a few of them.

Do you know where to find the site’s error log? If so, usually the “500” errors should have a more detailed message about what went wrong, in that log.

One possibility, if your host is running Apache 2.4, some of the directives in .htaccess have changed since Apache 2.2. If they install mod_access_compat, the 2.2-compatible version will still work. (The message in the error log file will help confirm if this is the issue.)

Also, do you use CloudFlare or any other reverse proxy? I’ve heard of one case where CloudFlare was set to pass IPv6 traffic to the server, but the server’s PHP wasn’t compiled with IPv6 support. If you have a copy of the .htaccess file that causes the 500 error, that could help narrow down the issue, too.

-Matt R

One possibility, if your host is running Apache 2.4, some of the directives in .htaccess have changed since Apache 2.2.

I did not know that. Does that mean the directives you add to .htaccess won’t work in 2.4? I am running 2.4.7.

Indeed, the error log shows several lines I’m not familiar with like:

[Sun Nov 01 19:42:30.963839 2015] [core:alert] [pid 21275] [client 71.218.76.82:46654] /var/www/.htaccess: order not allowed here, referer: https://www.churchofgodperspective.org/wp-content/plugins/wordfence/css/main.css?ver=37d2c930d8517afa8039eac193c2f226
[Sun Nov 01 19:42:34.092275 2015] [core:alert] [pid 21060] [client 71.218.76.82:46656] /var/www/.htaccess: order not allowed here, referer: https://www.churchofgodperspective.org/wp-admin/admin.php?page=WordfenceSitePerf

No, I am not using CloudFlare or anything like that.

My .htaccess file is custom but not overly convoluted:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
# See https://www.javascriptkit.com/howto/htaccess14.shtml
# The following causes 500 errors
#Options +FollowSymlinks
# Block by referrer, from https://www.htaccess-guide.com/deny-visitors-by-referrer/
# Modified using https://www.htaccesstools.com/block-hitbots/
RewriteCond %{HTTP_REFERER} ^([^.]+.)*?lanud-adisutjipto.mil.id.*$ [NC,OR]
#RewriteCond %{HTTP_REFERER} ^([^.]+.)*?google.com/search\?q\=2\+guys\+1\+horse$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^([^.]+.)*?fr-voyage.com.*$ [NC]
#RewriteCond %{HTTP_USER_AGENT} ^x00_-gawa\.sa\.pilipinas\.2015 [NC]
RewriteRule .* - [F,L]

RewriteBase /

# Rewrite subdomains to directories
RewriteCond %{HTTP_HOST} ^wiki\.cogperspective\.org [OR]
RewriteCond %{HTTP_HOST} ^wiki\.churchofgodperspective\.org
RewriteRule ^(.*)$ https://www.churchofgodperspective.org/wiki/$1 [R=301,L]

RewriteCond %{HTTP_HOST} ^blog\.cogperspective\.org [OR]
RewriteCond %{HTTP_HOST} ^blog\.churchofgodperspective\.org
RewriteRule ^(.*)$ https://www.churchofgodperspective.org/blog/$1 [R=301,L]

# Force "www"
RewriteCond %{HTTP_HOST} ^cogperspective\.org [OR]
RewriteCond %{HTTP_HOST} ^churchofgodperspective\.org
RewriteRule ^(.*)$ https://www.churchofgodperspective.org/$1 [R=301,L]

# Mediawiki additions
# Short url for wiki pages
RewriteRule ^/?wiki(/.*)?$ %{DOCUMENT_ROOT}/w/index.php [L]
# Redirect / to Main Page
RewriteRule ^/*$ %{DOCUMENT_ROOT}/w/index.php [L]

RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

The .htaccess changes should work in Apache 2.4 as long as mod_access_compat is enabled, and it usually is on most hosts. From the error message you posted above though, “order not allowed here”, it sounds like the main Apache config may have “AllowOverride None” — or some other options, but not including “Limit”, which prevents you from using certain directives in the .htaccess file.

If the host adds “Limit” to the AllowOverride directive in the main config file and restarts the server, using “Order” in .htaccess should work. If it doesn’t work, there should be a new error in the error log about something else that is missing or disabled.

If the server is your own VPS or dedicated server, the documentation for AllowOverride is here if you need it — just make sure to update the right AllowOverride, that only affects the web root (not “/”):
Apache 2.4 – AllowOverride

Let me know if this helps, or if you have any other questions.

-Matt R

OK, that does help in that adding Limit to the AllowOverride directive worked. I’m not without some sense of confusion, though.

From what I understand, “Order Deny,Allow” is the default, so is it necessary? More to the point, I see no other deny or allow statements, so could this have been fixed simply by commenting that line out?

My second concern is that, since this is deprecated, could this cause issues down the road?

At any rate, I’m going to run it like this for a day or so unless I run into issues. If it seems to be working and keeping the load down, then I’ll make it permanent.

Some hosts may change the default Order directive, so that line ensures that any Deny lines are still effective when they are used. When an IP is blocked by Wordfence while Falcon is active, it will add a “Deny” line to .htaccess for that IP, for a big performance increase, since the block will take effect before WordPress even loads.

Our dev team will keep an eye on this to make sure that the 2.4-style directives are used before Apache removes support for the 2.2-compatible methods, so as long as your site is using the latest version of Wordfence, this should continue to work.

Let us know if you have any more questions, or if there are any more issues. Thanks!

-Matt R

OK, after playing with this, I’m considering this solved. Having said that, it appears that caching for me makes matters worse, espectially the high level Falcon caching. The lower level worked, for a while, but even it eventually spikes and goes wonky. I think I’m just going to move up to the next level on the VPS and increase the virtual memory in addition to the RAM increase.

Thank you for following up. It’s definitely unusual to get worse performance when enabling caching.

If you have a moment, I’d like to know more about your server, so we can see what may have caused the issue, but if you don’t have time, that is OK, of course!

If you do have time, you can go to Wordfence’s Scan page, and click the link “Email activity log” at the top-right corner of the “Scan Detailed Activity” box, and enter my email address: mattr (at) wordfence.com — this will send me your latest scan log, and details about the server, such as the PHP version, headers that may be set by other caches, etc.

-Matt R