issue in wordfence plugin

Hi @ghina1 ,

Thank you for reaching out to us. Please accept our sincere apologies for the delayed response.

To help us look into your issue and advise, please send a diagnostic report to wftest @ wordfence . com. You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE:It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,
Janet

@wfjanet I have sent the diadnostic report for wftest @ wordfence . com

awaiting your kind feedback.

Hi @ghina1,

Thank you for sending this through. Everything looks good on the diagnostic report.

I suspect this could be a false positive issue that can be resolved by switching the firewall to Learning Mode. Sometimes, WordPress plugins or themes may exhibit behavior that resembles known attack patterns which results in the Wordfence Firewall blocking something that is not malicious.

From the Wordfence Dashboard click on Manage WAF. Then you will see Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. Now proceed to confirm whether you still experience these issues. This will help Wordfence learn that these actions are normal and it will allow them in the future. Once done, switch the WAF from Learning Mode back to Enabled and Protecting then test to see that you are getting the same errors.

I also noticed that more than one IP addresses are in use for the “X-Forwarded-For” value on the diagnostic file. It would be great to confirm that Wordfence is detecting visitor IPs correctly. To confirm, navigate to Wordfence > Tools > Diagnostics > IP Detection and confirm that it displays the IP address shown on https://whatsmyip.com/.

Please let me know what you find.

Thanks,
Janet.

@wfjanet thanks for your feedback. I have already enabled the learning mode and then the protecting mode.

the plugin can not scan the website and each time the scan failed with this message displayed:

Scan Failed
The current scan looks like it has failed. Its last status update was 6 minutes ago. You may continue to wait in case it resumes or stop and restart the scan. Some sites may need adjustments to run scans reliably. Click here for steps you can try.

also, the server state is unknown always.

I have sent you a screen shoot for the error and the result to [email protected] email as I can not upload an image here, can you please check it.

awaiting your kind feedback.

@wfjanet also in
X-Forwarded-For 188.247.64.179, 64.252.87.124

there are 2 ip addresses and when I checked whatsmyip it shows 188.247.64.179

Hi

Try enabling the option “Start all scans remotely” found in the “Debugging Options” section at the bottom of the “Diagnostics” tab on the Wordfence “Tools” page. If the scan still fails, please do the following for me:

• Go to the Wordfence > Tools > Diagnostics page
• In the “Debugging Options” section check the circle “Enable debugging mode”
• Click to “Save Changes”.
• CANCEL any current scan and start a NEW scan
• Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log once the scan finishes and paste them in this post.

Wordfence > Tools > Diagnostic > Debugging Screenshot

This will help me see exactly what is happening when the scan fails.

On the IP address, I’d recommend that you add the second IP address – 64.252.87.124 to the Trusted Proxies. To do this, go to Wordfence > All Options > General Wordfence Options >How does Wordfence get IPs and click on the text link +Edit trusted proxies to add the IP address. I also noticed that this IP is different from the one on the diagnostic file so there is a possibility that it changes regularly. Confirm this with your host so that you can add all the IP addresses.

Let me know if you have any questions.

Thanks,

Janet

@wfjanet – I have enabled the option “Start all scans remotely” in “Debugging Options”
and when I scan the website I got this error:

“Scan Failed
The scan has failed to start. This is often because the site either cannot make outbound requests or is blocked from connecting to itself. Click here for steps you can try.”

– When I Enabled debugging mode, below is the log file:

[Mar 24 22:59:22] Analyzed 500 files containing 52.85 MB of data so far
[Mar 24 22:59:22] Analyzed 600 files containing 53.55 MB of data so far
[Mar 24 22:59:25] Analyzed 700 files containing 70.49 MB of data so far
[Mar 24 22:59:25] Analyzed 800 files containing 71.95 MB of data so far
[Mar 24 22:59:26] Analyzed 900 files containing 77.62 MB of data so far
[Mar 24 22:59:27] Analyzed 1000 files containing 82.85 MB of data so far
[Mar 24 22:59:27] Analyzed 1100 files containing 84.98 MB of data so far
[Mar 24 22:59:28] Analyzed 1200 files containing 85.24 MB of data so far
[Mar 24 22:59:29] Analyzed 1300 files containing 88.16 MB of data so far
[Mar 24 22:59:29] Analyzed 1400 files containing 88.93 MB of data so far
[Mar 24 22:59:30] Analyzed 1500 files containing 90.57 MB of data so far
[Mar 24 22:59:31] Analyzed 1600 files containing 92.15 MB of data so far
[Mar 24 22:59:32] Analyzed 1700 files containing 92.98 MB of data so far
[Mar 24 22:59:33] Analyzed 1800 files containing 94.06 MB of data so far
[Mar 24 22:59:35] Analyzed 1900 files containing 95.22 MB of data so far
[Mar 24 22:59:35] Analyzed 2000 files containing 95.61 MB of data so far
[Mar 24 22:59:36] Analyzed 2100 files containing 95.87 MB of data so far
[Mar 24 22:59:37] Analyzed 2200 files containing 96.87 MB of data so far
[Mar 24 22:59:38] Analyzed 2300 files containing 97.97 MB of data so far
[Mar 24 22:59:38] Analyzed 2400 files containing 98.61 MB of data so far
[Mar 24 22:59:39] Analyzed 2500 files containing 98.99 MB of data so far
[Mar 24 22:59:41] Analyzed 2600 files containing 100.98 MB of data so far
[Mar 24 22:59:42] Analyzed 2700 files containing 101.17 MB of data so far
[Mar 24 22:59:42] Analyzed 2800 files containing 102.69 MB of data so far
[Mar 24 22:59:43] Analyzed 2900 files containing 103.19 MB of data so far
[Mar 24 22:59:44] Analyzed 3000 files containing 104.58 MB of data so far
[Mar 24 22:59:44] Analyzed 3100 files containing 110.05 MB of data so far
[Mar 24 22:59:45] Analyzed 3200 files containing 110.89 MB of data so far
[Mar 24 22:59:46] Analyzed 3300 files containing 112.25 MB of data so far
[Mar 24 22:59:46] Analyzed 3400 files containing 112.9 MB of data so far
[Mar 24 22:59:47] Analyzed 3500 files containing 113.73 MB of data so far
[Mar 24 22:59:48] Analyzed 3600 files containing 115.1 MB of data so far
[Mar 24 22:59:48] Analyzed 3700 files containing 116.89 MB of data so far
[Mar 24 22:59:49] Analyzed 3800 files containing 118.02 MB of data so far
[Mar 24 22:59:50] Analyzed 3900 files containing 122.63 MB of data so far
[Mar 24 22:59:50] Analyzed 4000 files containing 128.57 MB of data so far
[Mar 24 22:59:51] Analyzed 4100 files containing 131.78 MB of data so far
[Mar 24 22:59:52] Analyzed 4200 files containing 133.52 MB of data so far
[Mar 24 22:59:52] Analyzed 4300 files containing 145.15 MB of data so far
[Mar 24 22:59:53] Analyzed 4400 files containing 145.43 MB of data so far
[Mar 24 22:59:54] Analyzed 4500 files containing 145.82 MB of data so far
[Mar 24 22:59:54] Analyzed 4600 files containing 146.09 MB of data so far
[Mar 24 22:59:55] Analyzed 4700 files containing 146.22 MB of data so far
[Mar 24 22:59:55] Analyzed 4800 files containing 146.62 MB of data so far
[Mar 24 22:59:56] Analyzed 4900 files containing 146.87 MB of data so far
[Mar 24 22:59:56] Analyzed 5000 files containing 147.45 MB of data so far
[Mar 24 22:59:59] Analyzed 5100 files containing 163.61 MB of data so far
[Mar 24 22:59:59] Analyzed 5200 files containing 166.99 MB of data so far
[Mar 24 23:00:00] Analyzed 5300 files containing 167.74 MB of data so far
[Mar 24 23:00:01] Analyzed 5400 files containing 168.66 MB of data so far
[Mar 24 23:00:01] Analyzed 5500 files containing 168.73 MB of data so far
[Mar 24 23:00:02] Analyzed 5600 files containing 172.85 MB of data so far
[Mar 24 23:00:03] Analyzed 5700 files containing 174.36 MB of data so far
[Mar 24 23:00:04] Analyzed 5800 files containing 174.51 MB of data so far
[Mar 24 23:00:04] Analyzed 5900 files containing 174.75 MB of data so far
[Mar 24 23:00:05] Analyzed 6000 files containing 175.56 MB of data so far
[Mar 24 23:00:06] Analyzed 6100 files containing 179.86 MB of data so far
[Mar 24 23:00:06] Analyzed 6200 files containing 180.38 MB of data so far
[Mar 24 23:00:07] Analyzed 6300 files containing 180.53 MB of data so far
[Mar 24 23:00:07] Analyzed 6400 files containing 181.13 MB of data so far
[Mar 24 23:00:08] Analyzed 6500 files containing 181.61 MB of data so far
[Mar 24 23:00:09] Analyzed 6600 files containing 182.44 MB of data so far
[Mar 24 23:00:09] Analyzed 6700 files containing 182.78 MB of data so far
[Mar 24 23:00:10] Analyzed 6800 files containing 189.56 MB of data so far
[Mar 24 23:00:11] Analyzed 6900 files containing 194.72 MB of data so far
[Mar 24 23:00:11] Analyzed 7000 files containing 195.32 MB of data so far
[Mar 24 23:00:12] Analyzed 7100 files containing 197.59 MB of data so far
[Mar 24 23:00:13] Analyzed 7200 files containing 198.06 MB of data so far
[Mar 24 23:00:13] Analyzed 7300 files containing 199.17 MB of data so far
[Mar 24 23:00:15] Analyzed 7400 files containing 199.68 MB of data so far
[Mar 24 23:00:16] Analyzed 7500 files containing 200.88 MB of data so far
[Mar 24 23:00:16] Analyzed 7600 files containing 201.22 MB of data so far
[Mar 24 23:00:17] Analyzed 7700 files containing 211.83 MB of data so far
[Mar 24 23:00:18] Analyzed 7800 files containing 213.75 MB of data so far
[Mar 24 23:00:18] Analyzed 7900 files containing 214.22 MB of data so far
[Mar 24 23:00:19] Analyzed 8000 files containing 215.07 MB of data so far`

and this is the second scan log:

[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Exceptions/SquareRootException.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Exceptions/UnrecognizedAddressException.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Exceptions/UnrecognizedScriptForAddressException.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Exceptions/WitnessScriptException.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/ElectrumKey.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/ElectrumKeyFactory.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/HdPrefix/GlobalPrefixConfig.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/HdPrefix/NetworkConfig.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/HdPrefix/ScriptPrefix.php (Mem:34.0M)
[Apr 10 12:21:35] Scanning: /opt/bitnami/apache/htdocs/wp-content/plugins/mycryptocheckout/vendor/bitwasp/bitcoin/src/Key/Deterministic/HierarchicalKey.php (Mem:34.0M)
[Apr 10 12:21:35] Analyzed 8500 files containing 146.83 MB of data so far
[Apr 10 12:21:36] Calling fork() from wordfenceHash with maxExecTime: 15
[Apr 10 12:21:36] Entered fork()
[Apr 10 12:21:36] Calling startScan(true)
[Apr 10 12:21:36] Got value from wf config maxExecutionTime: 0
[Apr 10 12:21:36] Got max_execution_time value from ini: 30
[Apr 10 12:21:36] getMaxExecutionTime() returning half ini value: 15
[Apr 10 12:21:38] Test result of scan start URL fetch: array ( 'headers' => Requests_Utility_CaseInsensitiveDictionary::__set_state(array( 'data' => array ( 'content-type' => 'text/html; charset=UTF-8', 'content-length' => '32', 'date' => 'Sun, 10 Apr 2022 08:21:38 GMT', 'server' => 'Apache', 'x-robots-tag' => 'noindex', 'x-content-type-options' => 'nosniff', 'expires' => 'Wed, 11 Jan 1984 05:00:00 GMT', 'cache-control' => 'no-cache, must-revalidate, max-age=0', 'x-frame-options' => 'SAMEORIGIN', 'referrer-policy' => 'strict-origin-when-cross-origin', 'vary' => 'X-Forwarded-Proto,Accept-Encoding', 'content-encoding' => 'gzip', 'x-cache' => 'Miss from cloudfront', 'via' => '1.1 7f761c2ffb9626f6a53e34913ba35aee.cloudfront.net (CloudFront)', 'x-amz-cf-pop' => 'DUB56-P1', 'x-amz-cf-id' => 'vNMS_qfrSdaA1ormVE-UYJ_UyK26vw8HWt02oaG0Z2ht9UFi8bvr3A==', ), )), 'body' => 'WFSCANTESTOK', 'respons
[Apr 10 12:21:38] Starting cron with normal ajax at URL https://www.ibtikar.io/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=5e10b0170c522a396327a893b9aa64a2&signature=a5b593c93e3a229d268951197372b156b26f24f321b04c1189209877d0ef5748
[Apr 10 12:21:39] Scan engine received request.
[Apr 10 12:21:39] Verifying start request signature.
[Apr 10 12:21:39] Fetching stored cronkey for comparison.
[Apr 10 12:21:39] Checking cronkey: 5e10b0170c522a396327a893b9aa64a2 (expecting 5e10b0170c522a396327a893b9aa64a2)
[Apr 10 12:21:39] Checking saved cronkey against cronkey param
[Apr 10 12:21:39] Requesting max memory
[Apr 10 12:21:39] Setting up error handling environment
[Apr 10 12:21:39] Setting up scanRunning and starting scan
[Apr 10 12:21:39] Scan process ended after forking.
[Apr 10 12:21:39]  Fatal error: Out of memory (allocated 40284160) (tried to allocate 20480 bytes) in /opt/bitnami/apache/htdocs/wp-content/plugins/wordfence/lib/wfConfig.php on line 677 There has been a critical error on this website.Learn more about troubleshooting WordPress.

all scans failed.

Hi @ghina1,

Thank you for sending the logs.

I was able to identify an issue from the logs you shared with me.

Fatal error Out of Memory (Last Line) indicates that more memory needs to be allocated to PHP. PHP memory is cumulative meaning that the amount set in php.ini is shared between all plugins, themes, WordPress, and any other non-WordPress apps installed in the site folder. This can be resolved by:

• Upgrading to PHP 7 or above since it introduced better memory handling.
• Changing the Memory Limit in the php.ini file to 256M

If you are unable to make the changes, please contact your site administrator or hosting provider and work with them to determine what your memory limit is and whether you can upgrade it.

In case the issue still persists even after a memory upgrade, go to Scan > Scan Options and uncheck the Scan images, binary, and other files as if they were executable option as it can consume a significant amount of memory to open causing the scan to fail.

For your reference, please see the steps to follow when retrying the scans.

• Kill the existing scan if it is still running (The “Start New Scan” button turns into a “Stop” button while the scan is running)
• Go to your Scan > Scan Options and Scheduling page and locate the “Performance Options”
• Set “Maximum execution time for each scan stage” to 30 on the options page
• Click to “Save Changes”
• Go to the Tools > Diagnostics page
• In the “Debugging Options” section leave the “Enable debugging mode” option checked
• Uncheck the option “Start scan remotely”
• Click to “Save Changes”.
• Start a new scan

In case the scan still fails, copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log once the scan finishes and paste them in this post.

Please let me know how it goes.

Thanks,
Janet