WAF keeps reverting to learning mode

  • Fresh install of the latest WordPress with Wordfence.
    My Web Application Firewall keeps putting itself back in learning mode, even though I manually set it to activated.

    No process is touching the wflogs folder. Only other plugins installed are Jetpack, Akismet and WP-Piwik, all on pretty standard settings.

    Did a full security scan on high sensitivity, I only get some false positives on a piwik installation (analytics) on the same server.

    What can cause my WAF to revert to learning mode? My site has been under active attacks lately, and I’d really like it to be fully protected.

Viewing 8 replies - 1 through 8 (of 8 total)

  • Hello @forceflow,

    When the WAF reverts to Learning Mode, does it provide a specific date that it turns on?

    While you mention no process is touching the wflogs folder, I’m curious if there is a manually configured malware scanner on the server that sees the config.php file in the wflogs folder and deletes it. This would trigger the firewall to go back into Learning Mode.

    Thanks,
    Steve

    Thread Starter forceflow

    (@forceflow)

    Actually, the reverting to Learning mode seems to coincide with Wordfence’s own scanning. I’ve disabled auto scan for now, and the mode stays enabled. When I manually start a scan, I can see the firewall being reverted to learning mode within a few minutes.

    Hi @forceflow

    Sorry for my late reply, I’m following up with you on this thread and I’ve a suggestion which might help in resolving this issue, please try enabling “Use low resource scanning” option under (Wordfence > Scan > Scan Options and Scheduling > Performance Options).

    Let me know how it goes,
    Thanks.

    @wfalaa We have the same issue and have had to resort to manually checking the firewall status everyday to make sure it is enabled and not in learning mode. I’ve just turned on the low resource scanning to see if that helps.

    It would be really nice if the “automatic re-enable” was 24 hrs instead of 1 week – or if this period of time was user configurable.

    Thread Starter forceflow

    (@forceflow)

    I’ll try the suggested fix.

    Thread Starter forceflow

    (@forceflow)

    Update: the suggested fix does not help. Firewall keeps reverting to learning mode for unknown reason.

    Just to add – I am encountering the same issue on one of our websites. I’ll see if turning off scanning stops this behaviour.

    It’s happened to me twice recently. I will also try the no scanning option – but interested to hear if anyone has a better solution …

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘WAF keeps reverting to learning mode’ is closed to new replies.