Error Log growing exponentially

Hi @babysleepsite, thanks for reaching out.

The only contents that should be inside wordfence-waf.php in cases such as yours are:

<?php
// Before removing this file, please verify the PHP ini setting auto_prepend_file does not point to this.

if (file_exists(__DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php')) {
	define("WFWAF_LOG_PATH", __DIR__.'/wp-content/wflogs/');
	include_once __DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php';
}

Note no closing PHP tag ?> or calls to $waf or $wp at all. The error log warnings have alerted you to what is likely malicious code insertion on your site. For the benefit of anybody else referencing this topic, if you used the “INCLUDE” option when optimizing the firewall, you may see another filename included at the top of the file – this is expected.

You could certainly try removing the lines below the } to fix the warning, but I am concerned that something will just regenerate the code again, hinting at a bigger problem.

As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure to do this.

I will provide our site cleaning instructions for you: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

XML-RPC requests are one of the most common brute force/credential stuffing attack methods so we always recommend using long unique passwords along with 2FA for your administrative accounts.

Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful. If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers one, but there are others.

Thanks,
Peter.

Hi Peter,

Oh, wow, thank you! Wordfence had alerted me to the possible malicious code in that file but the option was only to delete the file and then my entire site broke so I thought it was a false positive. I should have looked into that further, I guess. I hadn’t had any other problems so I didn’t worry about it.

As a quick check, I removed the code and the site seems to be working and, so far, the code hasn’t been put back. But, I will change all passwords and read through all the documents you sent.

Thank you so much!

By the way, I’ve had 2FA set up for quite a while on WordPress and used WordFence Premium for years, now, so this must be an FTP-type thing, I guess.