Fatal Error with wordfence

Hello @maximiwanow,

It seems as if some file paths changed in the move from one host to the other.

In the future, to avoid this issue, it is important to use the ‘Remove Extended Protection‘ option in (Wordfence > Firewall > All Firewall Options underneath Protection Level) before migrating hosts.

In this case, you will need to delete references to wordfence-waf in the .htaccess, .user.ini, and/or php.ini files.

You can search these files for “wordfence-waf”. These references will look like so:

php_value auto_prepend_file "/path_to_file/wordfence-waf.php"

auto_prepend_file = '/home/username/website.com/wordfence-waf.php'

After you remove those references of wordfence-waf from the files, you can go ahead and manually remove the wordfence-waf.php file.

You should then have access to your site, where you can then set up extended protection again via the firewall page.

-Scott

Thank you.

I am having the same issue. My use case is that I am trying to move two wordpress installations (both WordFenced) to a different volume on my Synology NAS.

The first time I encountered the error I decided to deactivate and delete WordFence. But that made no difference.

It’s unfortunate that deleting WordFence does not remove all artifacts. Is there a reason for that? Can that be changed please?

Yes, it’s quite frustrating.
I took me a while to investigate and resolve the case. I removed Wordfence and the error above appeared.
Then (via SSH) found .user.ini had few lines of code, which were “looking” for the file wordefence-waf.php, which I removed. Below you can see them:

Wordfence WAF
auto_prepend_file = '/path_to_file/wordfence-waf.php'
; END Wordfence WAF

You can either comment the lines or delete/rename .user.ini to resolve the issue.

I am having the same problem, can you please help me? I did all the steps, but when I delete user.ini it shows me error on not establishing the database.

hi ,

my site is down , have erased part that was in but do I have to erase anything else in htaccess file ?

this is my htaccess file

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ – [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# Wordfence WAF
<Files “.user.ini”>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>

# END Wordfence WAF

# php — BEGIN cPanel-generated handler, do not edit
# Set the “ea-php56” package as the default “PHP” programming language.
<IfModule mime_module>
AddType application/x-httpd-ea-php56 .php .php5 .phtml
</IfModule>
# php — END cPanel-generated handler, do not edit

It is best to make a backup of that file before making changes, then you can likely remove the code inside of # Wordfence WAF and # END Wordfence WAF, if the firewall optimization is the issue. Here is the documentation on that: https://www.wordfence.com/help/firewall/optimizing-the-firewall/#removing-the-optimization

As per forum rules, if you need any more support, please open a new thread and we will be happy to give you a hand there.

I did , but the site is white as a feather .

removed it and waiting , should I ask my provider to just restore an old backup ?

Thank you wfscott, it worked like a charm!