Life Scan & Blocked IP's pages behave weird

P.S. Today I got a strange warning, while Firefox kept crashing (a few seconds blanc) on the page ‘blocked IP’s’.
“Wordfence Live Activity: Warning: dns_get_record(): A temporary server error occurred in /home/boox/domains/booxalive.nl/public_html/wp-content/plugins/wordfence/lib/wfS…” There seems to be more, but whenever my mouse touches the screen (for copy/paste), this blanc crash appeares, and seems to get stuck with this script in my former post.
It drives me crazy…

There is definitely something unusual going on — does your site have any relation to gumroad.com, or is it a site that you have open in another tab or window? It is not normal for a script from their site to be loading, if not. If you do have their site open in the same browser, it may just be slowing down the entire browser. That could also happen if another site you are using (or your own site) has content loading from them directly, possibly in a widget.

Also, do you have any browser extensions installed? In Chrome, you can check by clicking the menu button and choosing Settings, then click on the Extensions link on the left side of the settings page. There should be a few default extensions installed (I think they’ll only be Google products), but if there are any that you’re not familiar with, they may be part of the problem.

Another item to check, if you can open the javascript console in Chrome or Firefox, do you see any errors listed in red while on those pages? If you’re not familiar with the javascript console, here are some instructions:
How to open the JavaScript console

The temporary server error may be a second problem, which could happen if your server is busy, but shouldn’t be related to the slowness while scrolling — if we can solve the first issue, then we can check on that one next.

-Matt R

Dear WFMattR!

Thanks só much for answering so quickly!

No, I never have heard from this gumroads and I certainly do not have opened this site in any tab or browser.
My site is just a sort of magazine with online picture books for children, with about 100 unique visitors a day.
I only have open every day as a standard: webmail / facebook / stats of my site / one page of my site (which can be edited).

Normally I use Firefox, where I only installed adBlock and FlashPlayer.
In the add-ons for the Java-script I found this notice:
“Java Plugin 7 update 45 to 78 (click-to-play), Windows is blocked for your safety. Old versions of the Java plugin are potentially insecure and unstable. All users are strongly recommended to update on our plugin check page.”

In both Chrome and FF is inactive: Freemake Video Converter

Here are the java-scripts for the two weirdbehaving pages:
https://booxalive.nl/wordfence-screenshots/

I hope the Sherlock Holmes in you can sort something out!

Ok. In the two screenshots you had posted, can you go to the same pages again, then click on the last tab titled “console”, and post anything shown there as well?

There are two other things you can try, too:

1. Try temporarily disabling all other plugins, and see if the two pages are still slow. If that fixes the problem (temporarily), you can try turning on one plugin at a time, and checking those pages for slow response again. If you find one that makes it slow, then that would be the one causing the conflict.

2. On the Wordfence Options page, in case this is a sign of hacked files, you can try turning on the last 3 scan options, and then go to the Wordfence Scan page, and manually run a scan. Don’t delete any files you’re not sure about yet, because these options are more aggressive, and might find some files that are actually ok.

With the screenshots and the plugin testing in #1 above, hopefully that will narrow down the problem. Let us know how what you find.

-Matt R

First I show you the consoles, for the other options scare me – sorry.
https://booxalive.nl/wordfence-screenshots/

I must say that even uploading images in my WP-editor for this screenshot page causes Firefox also to behave weird (freeze of the page).

OFF:
And may I ask you: in ‘Pages not found’ there are loads of IP’s (mainly from Ashburn in US) who try to access page https://www.booxalive.nl/?author (and then 1 to 2 and 3 and so on). I always block them (with all the crashes and scripts enigma’s). Is my blocking correct or too protective?

I deactivated all the plugins except Wordfence.
Still that warning sign is flickering.
But ‘pages not found’ and ‘blockedIPs’ seem to go more smooth…

I activated the Stats plugin and all seems rather smooth scrolling in Wordfence, though Life Traffic is easier scrolling than Blocked IP’s, which page still is not too willing. But ‘make blocks permanent’ there does not give crashes immediately. No sign of that gumroad script so far.

Bytheway: I found the total warning!
[Oct 19 04:39:35] Warning: dns_get_record(): A temporary server error occurred. in /home/boox/domains/booxalive.nl/public_html/wp-content/plugins/wordfence/lib/wfScanEngine.php on line 851 Warning: Invalid argument supplied for foreach() in /home/boox/domains/booxalive.nl/public_html/wp-content/plugins/wordfence/lib/wfScanEngine.php on line 853

Hope it gives you a hint…

Sorry for my tsunami of info.
About #problem2:
When I scanned manually I suddenly on the scan-page noticed this:
“We have detected a change in the A records of your DNS configuration that may affect the domain booxalive.nl. An A record is a record in DNS that points a domain name to an IP address. A change in your DNS records may indicate that a hacker has hacked into your DNS administration system and has pointed your email or website to their own server for malicious purposes. It could also indicate that your domain has expired. If you made this change yourself you can mark it ‘resolved’ and safely ignore it.”
I just mailed this to my provider, so I hope I get an answer from him.

OFF: While enabling plugins one by one and checking each time whether ‘Blocked IP’s’ gets stuck in the mud, I realise that the little option below ‘Permanently block all temporarily blocked IP adresses’ is quite difficult to reach when one has a long list.
And with difficult scrolling one almost never can reach that option.
My question: would it be better to place that option on top of that page?

CONCLUSION (before going to bed): it seems that the Simple Facebook Plugin is the troublemaker. When I activated that one, Firefox went bezerk. So I closed that, and continued in Chrome. There all the scrolling is smooth in Wordfence.
When I opened Firefox again, it still crashed a few times when doublechecking plugins, and one gumroads script appeared again.
But I think I have to reboot my laptop and check it tomorrow again.

I really am sad about that Facebook plugin, I need that support so much.

Best wishes, Magda

Magda,

Thanks for all the additional details. I’ll try to answer all here, but let me know if I have missed any:

1. The freezing of the upload page was probably from the same cause.

2. The bad pages with “author=1”, etc. are scans from a bot trying to look for login information — blocking those is good.

3. The warning about DNS records changing is probably caused by the dns_get_record() error. Since it says it’s a temporary error, but it keeps happening, you may need to ask your host why dns_get_record() in PHP is not working. For the domain above, I see the IP address 185.12.13.14 — you could also confirm with your host that this is the correct IP for your site.

4. We actually just had another request to move “Permanently block all temporarily blocked IP addresses” to the top of the Blocked IPs list, so I have sent that on to the dev team!

5. For the Facebook plugin that you found to be the problem, you can also try reporting the issue on their support forum. If they know that one of the scripts was slowing down both Chrome and Firefox while the plugin was active, and it didn’t happen when it was inactive, they may be able to find the problem.

Also, I haven’t seen the blank IP addresses with just the blue underline like you had in some of the screenshots, but Chrome has been doing some strange things lately. They will probably fix that in the next Chrome update.

-Matt R

Dear Matt R!

Thank you for all the answers!

About #3: My IP address is 82.161.150.73. Not the one you mention here.
But the warning is gone now. My provider mailed me there is nothing changed with my IP address or their servers. I trust him very much, as he helped me before very succesfully. But yet I will send him your remark, to be on the safe side.

I use Wordfence now only in Chrome and all is/scrolls smoothly as it was before, yippie!!! (But without the Simple Facebook Plugin – I will contact them about this crux.)

Only one question remains: about the Java scripts that are troublemakers. Yesterday evening again gumroads popped up in Firefox (after eliminating all the plugins). And today I had a new one:
https://script.shoppingminds.com

As said, normally I use Firefox, where I only installed adBlock and FlashPlayer. In the add-ons for the Java-script I found this notice:
“Java Plugin 7 update 45 to 78 (click-to-play), Windows is blocked for your safety. Old versions of the Java plugin are potentially insecure and unstable. All users are strongly recommended to update on our plugin check page.”

(In both Chrome and FF is inactive: Freemake Video Converter)

Do I have to update that blocked Java plugin? Doesn’t Java do that automaticly? But what is more important: could that Java thingy also mess up with Wordfence?

Many thanks for your kindness and wisdom!!
Magda from sunny Amsterdam

PS: My provider asks why ‘dns_get_record’ has to work?
The IPaddress 185.12.13.14 is indeed HIS own server.

PS: The FacebookLike-plugin seemed to be predecated for about 4 months! They never warned about that. So that must be the discrepancy, don’t you think so too?
I deleted that one and found a new one which I’ll test the same way.