Wordfence blocks forum updates

[Whitegoodshelp]

Hello,

I have WordPress and Invision Community forums installed on the same web site. WordPress is in a WordPress folder and the forums are in a “forums” folder.

Every time my forums need an update the update is thwarted by Wordfence saying it has detected an unsafe operation. This then takes my forum down with an update is is operation notice.

If I turn off Wordfence though it’s too late, the update will not complete. So I have to do a recovery of the forum. I’ve had to do this several times because I’m an idiot and keep forgetting to turn off Wordfence first.

However, why is Wordfence always doing this when the forum is part of the same site and more importantly how can I stop it in future please?

Andy

• This topic was modified 5 years, 5 months ago by Whitegoodshelp.

[WFSupport]

Thanks for reaching out!

If you are using .user.ini (look in the root directory of your site for this), add a line to the forums directory’s (or any other folder you want to turn the firewall off for) .user.ini file (or create that file):
auto_prepend_file = none

If using .htaccess on PHP5:
<IfModule mod_php5.c>
php_value auto_prepend_file none
</IfModule>

If using .htaccess on PHP7:
<IfModule mod_php7.c>
php_value auto_prepend_file none
</IfModule>

That would prevent the firewall from operating in that directory and blocking operations. If you are only seeing this issue when updating the forums, then you can always put the firewall into Learning Mode on the Firewall > Manage WAF page, and then update the forums. What should do is whitelist that particular action in the firewall going forward so that it wouldn’t be blocked. Any time you run into an issue like that, use putting the firewall into learning mode as your first troubleshooting step to see if that helps.

Let me know if this solves your issue.

Tim

[Whitegoodshelp]

Many thanks. I did try learning mode once but it didn’t stop it happening again. I can try it again next time just in case though. I wouldn’t want to turn off Wordfence for the forum if it is doing valuable work. Can you explain why Wordfence constantly stops software already on the server from doing essential updates? That doesn’t make sense and is a security risk.

Andy

[Whitegoodshelp]

It would be great to get an answer to my last question please. Frankly, turning off firewall protection to solve and occasional annoyance is not really a good solution. I appreciate I can always temporarily turn off Wordfence before updating my forum but as I said in my original post I do keep forgetting because forum updates are relatively infrequent. I have to hold my hands up and admit that is my own fault, but I have a very valid question in wanting to know why word fence is blocking updates from software already installed on my server?

Surely it should be happy that it is being updated with potentially bug fixes and vulnerability flaws fixed? At the very least it would be helpful if Wordfence brought up a warning window which gave the administrator an opportunity to block or allow the process?

Many thanks

Andy

[WFSupport]

Then really the only workaround for doing the updates is to add the code when doing updates and removing it when done. That will leave the firewall intact for the rest of the site but disable it for the forums while you are updating. Create the .user.ini file in that directory and then rename it to something like .user.ini.bak when you are done with the update. I’m still not sure why the forums directory wouldn’t be respecting a .user.ini file for PHP directives if it is working in the main directory. Your hosting company may have more information about that.

Tim

[Whitegoodshelp]

OK. Thanks for replying.