WordFence Finds ERRORS in it’s own code on 27 sites!

  • Resolved deadparrotsoftware

    (@deadparrotsoftware)


    1 year, 7 months ago

    Ran a wordfence scan on 27 sites where we have wordfence (ALL set to same Wordfence options)

    At the end of scan (no site errors) Wordfence shows an error on its OWN wfscanengine.php file using a deprecated operation!

    All site running on dedicated server, Centos7.9, Plesk, Latest wordpress and wordfence, all WF parameters exceed what is required to run WF.
    If you need more info, we have it. The error repeats several times and is the EXACT same error on all 27 sites.

    We are in the process of building 300 WordPress software sites for our members, and would like to include a working version of WordFence as part of our security system on each site. Thanks!

    Below is the output (truncated, with our server full path redacted) from the log, running in DEBUG mode:

    Wordfence Full Activity Log[Apr 13 09:46:50:1681393610.179537:1:error] <br /> <b>Deprecated</b>: strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated in <b>/[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php</b> on line <b>2032</b><br /> <br /> <b>Depreca[Apr 13 09:46:41:1681393601.455216:1:info] Scan Complete. Scanned 51547 files, 41 plugins, 1 themes, 34 posts, 0 comments and 42065 URLs in 38 minutes 40 seconds.[Apr 13 09:46:41:1681393601.452735:2:info] Wordfence used 36.38 MB of memory for scan. Server peak memory usage was: 54.38 MB[Apr 13 09:46:41:1681393601.452080:1:info] ——————-[Apr 13 09:46:41:1681393601.445401:2:info] Done examining URLs[Apr 13 09:46:41:1681393601.443609:2:info] Examining URLs found in the options we scanned for dangerous websites
    [Apr 13 09:46:41:1681393601.125249:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.124703:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.124240:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.123708:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.123236:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.122648:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:41:1681393601.121965:1:error] strtotime(): Passing null to parameter #1 ($datetime) of type string is deprecated (8192) File: /[PATH-REDACTED]/wp-content/plugins/wordfence/lib/wfScanEngine.php Line: 2032[Apr 13 09:46:29:1681393589.294301:2:info] Total of 100 users left to process in password strength check.[Apr 13 09:46:29:1681393589.268173:2:info] Starting password strength check on 104 users.[Apr 13 09:46:29:1681393589.241381:2:info] Done examining URLs[Apr 13 09:46:29:1681393589.240591:2:info] Done host key check.[Apr 13 09:46:28:1681393588.968542:2:info] Checking 4 host keys against Wordfence scanning servers.[Apr 13 09:46:28:1681393588.967206:2:info] Examining URLs found in posts we scanned for dangerous websites[Apr 13 09:46:28:1681393588.901648:2:info] Done file contents scan[Apr 13 09:46:28:1681393588.862677:2:info] Done host key check.[Apr 13 09:46:28:1681393588.500128:2:info] Checking 5666 host keys against Wordfence scanning servers.[Apr 13 09:46:28:1681393588.462215:2:info] Asking Wordfence to check URLs against malware list.[Apr 13 09:46:28:1681393588.461806:2:info] Scanned contents of 38352 additional files at 32.14 per second[Apr 13 09:46:28:1681393588.180229:2:info] Scanned contents of 38345 additional files at 32.14 per second

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @deadparrotsoftware, thanks for your message.

    As they’re a non-fatal deprecation notice, therefore not stopping PHP or the scan itself from completing, you and your visitors shouldn’t see any negative effects. This seems to be happening when checking if the site’s own URL is on a blocklist.

    As we pass values to PHP and WordPress core functions, the value being null could be beause of an outside influence. As this isn’t a widespread issue on every installation of Wordfence out there, it could be worth checking whether another plugin is causing it. Try temporarily disabling your other plugins during a scan to see if the notice disappears. If it does, enable them one-by-one until the warning shows again.

    If it doesn’t help, I could pass a diagnostic report to our development team to help narrow down the cause. We’ll only require a report from one of the sites displaying these warnings. You can send this to wftest @ wordfence . com directly using the link at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

    Thanks,
    Peter.

    Thread Starter deadparrotsoftware

    (@deadparrotsoftware)

    I HIGHLY doubt that all 27 sites are on a “blacklist” – according to mxtoolbox NONE of them are. All green.

    And YES, we tested this by turning off nearly EVERY plugin – on 3 sites – and the error is till there. WE don’t post things unless we HAVE tested it as thoroughly as we can. It’s YOUR CODE generating the error during your own scan. ??

    Sid

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘WordFence Finds ERRORS in it’s own code on 27 sites!’ is closed to new replies.