Wordfence broken / broke site?

  • Backstory:
    I recently took over as Webmaster / junior dev / etc.
    I did not setup the plugin or the WordPress installation. The site was migrated from one host to another and it was in working order when I got it but there was so much to look into that I did not have enough time before it was time to start a SEO firm partnership and me as their contact.
    Credentials to the account which was used to install Wordfence is not available. Site seemingly worked fine without errors despite having the at the time latest update. (7.10.0)

    July 05
    The site started acting haywire and critical errors made most of the back-end malfunction.
    – WordPress top-bar not visible on pages outside dashboard.
    – WooCommerce stopped sync to their dashboard analytics.
    – Elementor editor didn’t work.
    – Tons of WordPress database errors in the server log (2,6MB file).
    (I’d love to send it to you.)

    I asked my current host to take a look at what’s going on. The first thing they wanted to do was to use an older backup of site + db. No dice.

    I asked if they had taken a look at the server error logs and by that logic they asked me if it was alright to remove it. I said “sure whatever makes it work” again – at this point I didn’t really get the gravity of what could happen if just removing a plugin without doing it properly. The site seemingly worked alright I thought but missed that the WooCommerce product editor looks bugged. It seems to work in the broad sense, but the interface is bugged. some WYSIWYG editor input fields have buttons at the top which aren’t working some fields are very much dragged out horizontally, they don’t scroll vertically. The right bar where the “update” button is located as well as “categories” lists all categories without the UI box that scrolls vertically. etc. I also got strange errors in the server log like “server-generated directory index forbidden by Options directive”, the wp-admin login page is complaining about not being secure even though we never had an issue before. This guy: “PHP Fatal error: Uncaught wfWAFStorageFileException: Unable to save temporary file for atomic writing.”

    I also have a small hunch that someone from RU sent their regards at the last line of the error log, it does however appear a few more times in the original albeit in the few last errors. There are also IP:s that seem to be from Amsterdam as well (not included in this excerpt).
    Here’s a small excerpt from the 2,6MB error log. Notice the referer url:
    [redacted] [Wed Jul 05 20:24:15.132276 2023] [php7:error] [pid 57120] [client REDACTED] PHP Fatal error: Uncaught wfWAFStorageFileException: Unable to save temporary file for atomic writing. in /data/7/3/73955e7d-281c-483a-8c3e-f1d87a9f775e/[redacted]/web/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php:35\nStack trace:\n#0 /data/7/3/73955e7d-281c-483a-8c3e-f1d87a9f775e/[redacted]/web/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php(659): wfWAFStorageFile::atomicFilePutContents('/data/7/3/73955…', 'saveConfig('synced')\n#2 {main}\n thrown in /data/7/3/73955e7d-281c-483a-8c3e-f1d87a9f775e/[redacted]/web/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php on line 35, referer https://xn--18-[rest-redacted-for-safety]

    I copied back the plugin from the backup and named it “wordfence_bak”
    and haven’t had server error logs since, and haven’t dared to touch it since and had no time to look up support before now.

    Closing words
    I understand that we’d need a premium subscription to get premium support but I’m begging you for some quality insight as how I could get your terrific plugin working again even if it means I have to manually somehow remove stuff so that we in the future can invest in a yearly subscription. Or do we have to invest in a subscription now to get real
    help?

    Thank you for any input.

    • This topic was modified 1 year, 4 months ago by swmkii.
    • This topic was modified 1 year, 4 months ago by swmkii.
    • This topic was modified 1 year, 4 months ago by swmkii.
    • This topic was modified 1 year, 4 months ago by swmkii.
Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @swmkii, thanks for getting in touch with us.

    The most common problem with migration is that it’s done while the Wordfence firewall is still optimized. When this happens, the auto_prepend_file directive in your .htaccess may be looking for the wordfence-waf.php file in the wrong location. When Wordfence is optimized, the path to your wordfence-waf.php file is not likely to ever be the same as a development environment or previous hosting platform.

    Manually altering the path to point to the correct (new) location or removing the line entirely and re-optimizing the firewall using our wizard are your two best options.

    You can read our documentation intended for site migrations here: https://www.wordfence.com/help/advanced/remove-or-reset/#migrate-with-wordfence

    Regarding the Unable to save temporary file for atomic writing message, that’s the Wordfence firewall failing to write. It may be caused by the above issue, although it may also be appropriate to delete the wp-content/wflogs folder via FTP or file manager. Wordfence will try to repopulate/recreate wflogs within 30 minutes, often sooner. You can check on your Wordfence > Tools > Diagnostics page for any local database or filesystem permission issues that might need to be resolved at the server.

    Thanks,
    Peter.

    Thread Starter swmkii

    (@swmkii)

    First of all; thanks a lot @wfpeter for giving me some depth and insight to the situation!

    I guess the developer at the other host could have told us about this but chose not to, so now I have to clean up their mess as well. They were the ones who installed Wordfence for upkeep. I’ve looked around for the wordfence_waf.php which normally should be in the root but it’s nowhere to be found, also searched wide for it but it’s not on the file server.
    There’s nothing in the .htaccess pointing to the file neither, no mention of Wordfence (not sure if it should be specifically in writing?).

    The host dev did mention that they were still (before deactivation at least) getting reports to the e-mail which was used to install Wordfence and as such recommended the “easiest method:” remove / uninstall it and re-install it if I want to keep using it.

    Even if I reactivate Wordfence and run the wizard, would it make me able to reassign the installation to another e-mail?
    My gut tells me “no” since the initial installation is done by first registering at wordfence.com and input the URL which it’s supposed to be installed so the user can monitor / edit some settings via wordfence/central as well. But I’d rather like to be mistaken.



    • This reply was modified 1 year, 4 months ago by swmkii.
    • This reply was modified 1 year, 4 months ago by swmkii.
    • This reply was modified 1 year, 4 months ago by swmkii.
    Plugin Support wfpeter

    (@wfpeter)

    Hi @swmkii, thanks for the extra information.

    .user.ini or .htaccess can contain a line such as auto_prepend_file = /path/to/wordfence_waf.php depending on the environment. If the wordfence_waf file and that line is totally missing, it may mean the firewall was never optimized. However, it’s totally safe for these not to be present as re-optimizing through our wizard will attempt to recreate these depending on the environment it detects you’re using.

    You could try entirely removing Wordfence and using the details at the top of the page linked in my previous post: https://www.wordfence.com/help/advanced/remove-or-reset/

    This would allow you to reinstall Wordfence from scratch, register for a free license with your own email address, and also specify a new email address in the “where to email alerts” section of Wordfence > All Options once you’re in. You can follow the process for new installations and registering for a free key here: https://www.wordfence.com/help/api-key/#installing-your-free-license-key

    Thanks again,
    Peter.

    Thread Starter swmkii

    (@swmkii)

    @wfpeter
    That’s great information. Thank you!
    With your help I have now completely removed Wordfence, database – login security and all; and can soon begin to reinstall it with the company account.

    Are there any other plugins or functionality within them if activated that could in any way clash with Wordfence for future reference?
    – Really Simple SSL
    – Jetpack (deactivated)
    – Redirection
    – WP Rocket

    Recommendation
    Is there a scenario where it’s better to install and update plugins before installing Wordfence and activating the self learning protocol or does it not matter?

    Asking because I’m currently using WP Staging to make duplicates of our site to test plugin updates and such. We don’t have the premium version so it’s using our current database.

    Best Regards,

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Wordfence broken / broke site?’ is closed to new replies.