Slow calls to noc4.wordfence.com

Hi @macsolve,

We haven’t received any other report of such issue with noc4.wordfence.com.

Can you confirm if the requests were actually completing or if they were timing out? Is it still happening?

Since we’ve redirected the calls to 127.0.0.1 (serverside using the hosts file) we can’t tell if it’s still happening.

Can’t tell if the calls timed out or succeeded. Can we tell from the Wordfence control panel somehow? The calls came from 109.74.11.91.

We’ll try to boil down a test case and get back about that.

(this is our company www.remarpro.com account)

I’ve created a simple test case which is using the same PHP-FPM pool as one of the affected sites.

Code and output below in the comment:
https://git.montania.se/snippets/10

I’m seeing consistent <1s response times with this script.

Also verified with Apache Bench that the connection does not seem to be the problem.

https://git.montania.se/snippets/11

Could you provide some other URL to test?

I can also confirm that the issue is still present. Images from New Relic during my testing.

https://d.pr/o8xl5z
https://d.pr/M2bL86

Upon further investigation it seems that our disable_functions directive in the PHP-FPM pools was too strict and was causing issues for Wordfence.

Removing rmdir and rename from disabled functions seems to resolve the issue.

We’ll keep an extra eye on the sites but for now everything seems to be working as expected.

Hi @montania, @macsolve,

Thanks for letting us know! I’m glad you managed to identify the cause of the problem.

Were there any specific error messages indicating PHP functions related issues?

No, from checking out the source code almost all calls to rmdir and rename is suppressing error messages so our PHP error log did not reveal any problem.

I did check the wp-admin screens as well and everything was reporting OK there as well. If someone else has the same setup as us maybe you should add a check in in the Tools => Diagnostics screen to alert the user if required functions are disabled in PHP.

Hi @montania, @macsolve,

Thanks a lot for this suggestion!

I passed it on to our development team.