WordFence and BlueHost

  • Resolved MiaMcP

    (@miamcp)


    3 years, 7 months ago

    My site hosted on BlueHost was shut down today because BlueHost said: We have temporarily disabled public_html/onthewing/wings/wp-content/wflogs because it was causing performance issues on the server. Generally, we attempt to resolve these issues without disabling sites; however, this site began to affect the performance for all users on the system. In this case, we acted to preserve the overall server stability. The report at the end provides additional information about the site activity during this period.

    They also recommended: `Ask the customer to disable the plugin or If customer wants to keep the plugin, suggest :

    – Update the plugins to the latest version (It was)
    – Unchecking the box on the options page to “Enable automatic scheduled scans” and Save which will disable scheduled scans. (it was disabled)
    – If you have a lot of images, or large images, or large backup files, then disabling “Scan image files as if they were executable” which may make a big difference. (Wasn’t set to scan images even if the scan had been enabled)
    – You can usually also disable “Scan files outside your WordPress installation”, but that may not make much of a difference if you don’t have other non-WordPress folders. (Wasn’t checked to check files outside my WP install)
    – Make sure also near the bottom of the Options page that “Enable debugging mode” is not enabled — if you ever turned it on to check something, it can make your scans take longer if it was left on.` (wasn’t in debug mode)

    Now to be clear my site is huge, I’ve been blogging since 2011, haven’t missed a day in almost 6 years and it is a photo heavy site because I am a professional photographer.

    The thing is I disabled the WordFence scan years and years ago because the site is huge. Yet BlueHost wrote that the problem was with the scan?

    Once the site came back on line I verified that the WordFence scan was disabled. The tech I spoke to at BlueHost told me that WordFence was causing a problem server wide, not just on my site, my site just happened to be one that got shut down.

    So can anyone at WordFence tell me why BlueHost is saying that WordFence was causing a drain on the server’s resources? Is it a WordFence issue or a BlueHost Issue?

    I’ve deactivated WordFence on my site and two others that I host there that seemed to also be having issues.

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support WFAdam

    (@wfadam)

    Hello @miamcp and thanks for reaching out to us!

    Can you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    If you happen to have any PHP error logs, you could send those as well for us to review.

    I should be able to see if Wordfence is causing any performance issues.

    Thanks again!

    Thread Starter MiaMcP

    (@miamcp)

    @wfadam I sent the diagnostic report and additional information via email to the email address you mentioned. I had to deactivate WordFence again as soon as I sent the diagnostic report. I have my username in the subject line of the email I sent and in the body.

    Thank you for looking into this. Sorry I was slow to reply but I was out in the desert of Utah when you replied.

    Best,
    Mia

    Plugin Support WFAdam

    (@wfadam)

    Thanks @miamcp for sending that diagnostic!

    Yeah, it sounds like Bluehost has a list of scan performance things that they recommend if they think that Wordfence caused an issue. if you’re not using the scan, the host(bluehost) probably didn’t notice that the underlying cause isn’t related to the scanner.

    It’s likely that your site was under attack, if they saw that wflogs was being used heavily. I’m not sure without more detail from the host how they determined that wflogs was the issue, but the host mentioned “the report at the end”, so if you could send us that to wftest @ wordfence . com with subject “miamcp for WFADAM”, we might be able to see what they meant. I would like our QA team to have a look at those.

    If they have access logs for the site covering the time the issue occurred, that would help as well, so we could see if there were attacks going on at the time.

    Thank you so much for your help!

    Thread Starter MiaMcP

    (@miamcp)

    Adam,

    I sent the email.

    Plugin Support WFAdam

    (@wfadam)

    Thank you @miamcp for sending that information!

    So I see the site was using excessive CPU, but the larger part of the report is from the tool lsof (“list open files”), and it just shows that there were a bunch of php-fpm processes running under your user’s account, and two of them had wflogs files open. Note that each unique number in the 2nd column is a PID, and multiple lines with the same PID mean that one process had multiple files open. Bluehost doesn’t seem to know how those files are used, but they’re opened at the beginning of each web request when the WAF runs, and they’re closed at the end. Seeing that the files are open using a tool like lsof doesn’t necessarily mean there is anything wrong with them.

    If Bluehost is able to send access logs to the user, seeing what was happening at the time is still the best way to resolve the issue. The report from Bluehost doesn’t show that anything was broken, and it doesn’t show a reason that CPU usage was high.

    We really appreciate your help in taking a look at this. Anytime a host points the finger at us, we like to make sure that everything is working correctly on your site.

    Thanks again!

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘WordFence and BlueHost’ is closed to new replies.