GOTMLS flagging it’s own firewall rules as a backdoor script

I have mentioned many time the dangers and disadvantages of caching plugins, my advise is always to turn off caching and delete your cache file before scanning (I have also suggested omitting the cache folder from the scans, but that is not a great long term solution). Perhaps I should write an article on the subject of caching but it is an immense subject of which I have many beliefs that are unpopular with the caching community. I feel it would open a can of worms and begin an uphill battle.

I learned long ago not to store my definition in files because the filesystem was also being scanned be other security plugins and anti-virus software installed by the server admins at the host level, and my definitions have enough keywords in them to be flagged as suspicious at the least. That is why I stopped putting the definition for my plugin on the filesystem. You have seen that it is not just my plugin that flaggs this cache file but others like Wordfence also flag it, so the real problem here is that it is being written to the disk as a plain-test file.

That said the snippet you have posted here is not detected as any kind of threat by any of my current definitions. Can you send me the whole cache file or post the whole highlighted threat that was detected by my plugin?

The newest version of my plugin that I have just released now stores the definitions in an encoded blob so that your cached database records will not have any of those keywords in them that might be matched by any anti-malware software.

Please download the latest release and let me know if that works (don’t forget to clear any existing DB cache).

Hi Eli,

Thanks for responding so quickly, I apologise for not thanking you for your hard work in the first post, I had just had a very frustrating/worrying two days over this. I do find your plugin very useful as it often detects things that other security plugins don’t – I have also donated.

The update worked perfectly GOTMLS no longer flags the object cache as a backdoor script and wordfence also no longer flags it as suspicious.

RE: Caching, I understand your feelings on this, but when, as I am, you’re running sites with >200k visitors a month caching is a reality you can’t escape. I’m running REDIS, Varnish, Zend Opcode, Cloudflare, and a CDN on some sites and I need a plugin on the wordpress end of things to coordinate all of that, otherwise you can spend hours emptying caches. W3 Total Cache does that job nicely and offers other benefits like object and database caching which help to mitigate load on the server.

• This reply was modified 7 years, 9 months ago by toomanyairmiles.
• This reply was modified 7 years, 9 months ago by toomanyairmiles.