Problem with configuration

Hi @happik,

In order to check if this could be related to your environment, could you please check the Wordfence System Info page:

• Go to the Wordfence Tools page
• Click the Diagnostics tab
• In the Other Tests section (near the bottom of the page), click the link that reads “Click to view your system’s configuration in a new window“. This will open the Wordfence System Info page.

And check the values associated with the following parameters:

• Server API
• Loaded Configuration File (this will indicate the path to the php.ini file)
• PHP Version

Also please see our documentation for more information on how to optimize the Firewall depending on your environment.

Hi @wfyann.
The diagnostics tab shows these data:
Server API: FPM/FastCGI
Loaded Configuration File: /cfg/etc/php70-php.ini
PHP Version: 7.0.15

I have almost the latest PHP version and I have tried Apache + CGI/FastCGI (recommended based on tests) and waited long time (days) and there still appears the same Wordfence Live Activity:Idle and Firewall Protection Level: Basic WordPress Protection.

Should I write the code auto_prepend_file = '/home/k/karelleubner/www/leubner.cz/wordfence-waf.php' somewhere?

Where can I find the loaded configuration file?

Thank you,

B.R. Karel Leubner

Hi @happik,

Could you please check the .htaccess file (located at the root of your WordPress install which I believe in your case should be: /home/k/karelleubner/www/leubner.cz/) to see if you can find a “# Wordfence WAF” section where auto_prepend_file is set?

If that isn’t set, please make sure the user the Web server runs as has sufficient permissions to update the .htaccess file.

In case that is set, please check with your hosting provider if they have disabled the use of auto_prepend_file.

Hi @wfyann.

I have just received the information from my provider and he answered that I can modify the .htaccess file but he did not answered if the use of auto_prepend_file is enabled. I will specify it tomorrow to him by chat.

The part with WordFence WAF is here:

# Wordfence WAF
<Files “.user.ini”>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>

# END Wordfence WAF

where is the information about the auto_prepend_file? I have copied all website files by myself via FTP so I should have privileges to modify the files. Do you think the auto_prepend_file can be disabled?

Karel

Hi, I have had a discussion with my provider and I can auto_prepend_file manually in htaccess. Is this sufficient? What should I write there?

Karel

Dear all,

I have tried almost everything I have found on internet. I have added a line

php_value auto_prepend_file “/home/k/karelleubner/www/leubner.cz/wordfence-waf.php”

or

php_value auto_prepend_file “./wordfence-waf.php”

as is written in the documentation, but the “500 – Server error!” has occured. I am sure that the “wordfence-waf.php” file is in the root directory. Why is this happening? What should I write to the htaccess file?

Hello Karel (@happik),

It seems the user the web server runs as doesn’t have write access to the .htaccess file.
Could you please try and adjust the rights on the .htaccess file in order to allow the the web server user to update it.

Another option is to apply the Alternate method which is to append the following code to your php.ini:
auto_prepend_file = '/home/k/karelleubner/www/leubner.cz/wordfence-waf.php'

Dear @wfyann,

thank you for your ongoing contributions to this theme, I really appreciate it. I have tried new installation of wordpress with new database and wordfence and after some investigation I have found, that wordpress has modified my .htaccess file with following rows (as I have mentioned before):

# Wordfence WAF
<Files “.user.ini”>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>

# END Wordfence WAF

So I suppose the record to .htaccess by the WF plugin is allowed. The sentence

; Wordfence WAF
auto_prepend_file = '/home/k/karelleubner/www/leubner.cz/wordfence-waf.php'
; END Wordfence WAF

was recorded to the file user.ini that was created. I am not sure if something else is missing. Now I have the same situation:

a) There is still the notification: To make your site as secure as possible, take a moment to optimize the Wordfence Web Application Firewall: Click here to configure. Dismiss.
If you cannot complete the setup process, click here for help.

b) Wordfence Live Activity: Idle

c) Firewall: Protection Level – Basic WordPress Protection

Is it possible that all this is due to the learning mode that will stop after few days?

One more remark – I don’t know why but I do not have any php.ini file in the installation.

Hello @happik,

Sorry about the delayed response.

The location of the php.ini file appears on the Wordfence System Info page:
Loaded Configuration File: /cfg/etc/php70-php.ini

However, on sites with CGI/FastCGI, the firewall setup uses .user.ini.

From what you previously wrote I can see the .user.ini was populated with the correct information.

Is the Protection Level now showing Extended Protection?

Hi @wfyann.

The Protection level is showing Basic WordPress Protection.

There is still information:
To make your site as secure as possible, take a moment to optimize the Wordfence Web Application Firewall: Click here to configure. Dismiss
If you cannot complete the setup process, click here for help.

I suppose something is not well configured ??

• This reply was modified 7 years, 10 months ago by happik.
• This reply was modified 7 years, 10 months ago by happik.

@happik,

I’m still trying to figure out what’s happening with your Wordfence instance.

Could you please:

• Go to the Wordfence Tools page
• Click the Diagnostics tab
• Scroll down to the Send Report by Email section
• Send the report to yann[at]wordfence[dot]com

Hi @wfyann.

I have just send you the diagnostics report. If you agree we can manage a skype call. I can share my desktop and we can find the solution.

Thank you.

@happik – Please do not request off-forum help here, and do not post any external logon information here. The topics and discussions on the forums are for the benefit of everyone. If you need other assistance please contact the vendor on their official support channel:
https://support.wordfence.com/support/home

Thanks.

Hi @happik,

Thanks for providing the info.

According to the report you sent, it appears the options set in your custom php.ini / .user.ini files are being overridden as the value reported by Wordfence for the auto_prepend_file directive is: /system/www/patches/environment.php.

Please contact your hosting provider to see if they have PHP settings defined in a “pool” file.