Malware scanner doesn’t work

Hi there @shanghailander

I just tested by installing version 2.3.2 on my test site, and reset the plugin to its defaults under Defender > Settings, the ran a Malware Scan, which worked fine. I then updated progressively to each new version and scanned again. Each scan ran well as expected, so I was unable to replicate the issue on my own site.

It sounds like there may be something either blocking access to files or some of the requests Defender makes to the server during the process.

I understand you’re not too comfortable with the techy side of things, but are you able to check the debug.log located in the wp-content directory?

If you can check that debug.log file and see if there are any errors related to defender in there, that would be very helpful in troubleshooting this issue.

Another thing you can try is to deactivate and delete Defender from your site, then install a fresh copy. If it works as it should then, that would mean that a connection hiccup had interrupted the plugin update at some point and caused this

Cheers!
Patrick

Hi Patrick. Shanghailander’s SO here :). There is no debug.log in the wp-content folder for the site. the logs folder is also empty

Thanks
Philip

Hi Patrick

Thanks so much for answering my call for help! It was very much appreciated ?

I left the kinda-tecky stuff re your suggestion about the debug.log to my long-suffering husband but I did delete the Defender plugin yesterday and only re-installed it this afternoon.

Checked the malware scanner and again, no luck ?? Same as before – little wheel spinning valiantly on the left and nothing happening ??

I have a genealogical website (which I would hate to lose and Updraft doesn’t seem to be able to back up), and a website about ferrets, which is backed up by Updraft but which still isn’t able to do Defender’s malware scan!

Both are different themes and both worked fine with the Defender plugin until the 2nd but last update!

Thank you again for your very kind suggestions ??

Cheers

Nona

Hello @shanghailander ,

I’m sorry that this is still not working. Can you also check the browser console if there are any errors when the Malware Scan is stuck?
If yes, please send us a screenshot of the error.
https://developer.mozilla.org/en-US/docs/Tools/Browser_Console

kind regards,
Kasia

Hi Kasia

My apologies for taking so long to answer but it was hard to pin down my husband as he has been out and about a lot!

He told me what to do to get the screenshot for you so I did it but I can’t see any way to upload the image to this forum ???♀?

Could you please let me know your email address so that I can send it to you that way?

Many thanks for your help ??

Best wishes

Nona

Hey there @shanghailander thank you for following up.

In this case, we will need you to send this through our contact form, click here https://premium.wpmudev.org/contact/, in the subject, please add “ATTN: Jorge Diaz”

And include a link to the screenshot, perhaps you could upload it to Google Drive/Dropbox or any other similar service.

You could also use Monosnap which can help you to take the screenshot and upload it to the cloud to directly share the link with us.

Regards,

Jorge Díaz

Here you go

https://monosnap.com/file/49IK02ikrql1klABPFgVqQB2PWKUoj

Thanks ??

Hi @shanghailander

Thank you for the screenshot, we would need to have one from the Browser console:

https://monosnap.com/file/oeBgMVM7nbLzuzr2tSc0cqtlXLpoRG

The 0% stuck means the plugin is not able to trigger the scan, it usually happens if the cURL is not working or the WPMU DEV IPs are blocked on the server firewall.

Can you please send the screenshot of the browser console also ask your Hosting support to verify the server cURL and add the WPMU DEV IPs to the server > Firewall > Allow List:

https://wpmudev.com/docs/getting-started/wpmu-dev-ip-addresses/

Let us know the result you got,
Best Regards
Patrick Freitas

Here you go
https://monosnap.com/file/4Mvv8kFndnHrckTmgnSLqwSyWUKgZT

Hi @shanghailander

Thank you for the link

There is no console issue, so we can remove a JavaScript conflict from the troubleshooting.

Can you please contact your hosting support and ask about the information that I sent in the previous reply?

Let us know once hearing back from the hosting team
Best Regards
Patrick Freitas

Hi Patrick

Many thanks for letting me know there is no console issue.

I’ve forwarded your instructions to my husband and will try and pin him down when he gets back home to call our hosting company. No doubt he’ll let you know the answer once he speaks to them.

Cheers

Nona

Hi @shanghailander

Thank you for the update.

Sure, let us know once hearing back from hosting

Best Regards
Patrick Freitas

Hi @shanghailander

Let me return on this for a quick question.

Do you have any IP added in the blocklist in Defender > Firewall?

If so, can you copy the list of IPs to a TXT file, remove the banned IPs and run a new Defender scan?

It is possible the plugin itself blocked the server IP or the WPMU DEV IPs, in case the issue persists then it still need to contact the hosting support.

Let us know the result you got.
Best Regards
Patrick Freitas

Hi Patrick

Once again I must apologise for not keeping you in the loop!

Philip got in contact with our hosting company 2 Sundays ago and he was told that what he asked them would be handballed up the ladder and that they would send him an email within 24-48 hours.

Of course that didn’t happen and after a few days, Philip contacted the hosting company and the person on the other end promised they would give “upstairs” a prod to reply as they promised! So we are still waiting ??

I will do as you suggested re the blocklist tomorrow and let you know but I very much doubt that that is what is causing the problem.

I have 2 websites and both of them had Defender’s malware scanner working perfectly until the plugin was updated. If you look at my first post (which was 1 month, 1 week ago) the scanner stopped working on both websites two updates ago when I posted that comment – however you or someone with the same name tested the plugin after various updates and it all worked perfectly!

Philip will be speaking to our hosting company tomorrow (Saturday, April 3) so fingers crossed that he’ll be able to get some information out of them!!

Thank you for all your help so far – it is very much appreciated ?

Happy Easter (if you celebrate it) ??

Cheers

Nona

Hi Patrick

Philip finally got an email from our hosting company and I have copied and pasted it below. I hope it gives you some clues about the malware scanning!

Hello,

Thank you for contacting HostGator Support. My name is Kenneth and I had the pleasure of reviewing your case today. I apologize for the delay in our response time. We have been experiencing a higher than normal volume of requests.

I understand you contacted our support team about trouble with a 3rd party plugin for "pio-ulski.com". After reviewing your case, you contacted the support for this plugin, who advised you the issue could be with the server firewall or cURL trouble.

First, for shared hosting servers, HostGator does NOT whitelist access for IPs in the server firewall. This is due to you being in a shared environment, so whitelisting access would affect other users. However, HostGator does not generally block any specific IPs.

Second, for cURL, I can confirm cURL itself is working. However, I did see that when cURL-ing your specific domain, it was getting a 403 error (both from the server and from external locations). The code 403 mean permission denied or unauthorized. Again, HostGator does not block specific access, so most likely you have security settings you've put in place on your site specifically that is causing the cURL to be blocked.

Looking at your site, I see multiple security plugins installed that could be blocking the cURL request (based on user-agent most likely). Some plugins I see are "Wordfence Security", "All In One WP Security", and "Anti-Malware Security and Brute-Force Firewall". So, you may need to try disabling some of these plugins (or modifying settings in those plugins).

In addition to this, I also see various security rules and blocks setup in the htaccess file for the specific site. This is the file: /home1/kahlua/public_html/pio-ulski.com/.htaccess . Some of these rules are ones setup by the various security plugins you have installed. Though, I also see some IP deny rules are that denying your actual server IP as well (IP: 192.185.226.186) which is strange.

At this point, it could be that your malware scan from this 3rd party plugin is failing due to the cURL 403 error. However, this is not caused by the server firewall, but rather your specific security settings on the site. Since we did not setup this, we do not want to start modifying or disabling it to avoid any issues. I recommend that you review the configuration or seek assist reviewing it with a developer (or the providers of the plugins used).

If you have any questions or if anything was unclear, you can reply to this email for further assistance. For any other inquires, please contact our Live Support team at anytime. Our associates are available 24 hours a day 7 days a week.

Live Chat Support: https://chat.hostgator.com
Live Phone Support: (866)-964-2867

Warm regards,

Kenneth J.
Escalated Support