Wordfence “Scan process ended after forking.”

Hi @matsmtn,

If you’ve already tried the troubleshooting tips here, which you may have done by the sounds of things, then I have a few additional suggestions: https://www.wordfence.com/help/scan/troubleshooting/#scan-process-ended-after-forking

Go to your Wordfence > Scan > Manage Scan page and locate the “Performance Options” section. Set “Maximum execution time for each scan stage” to 20.

You could also set max_execution_time = 60 in php.ini, Wordfence’s scan only attempts to use half of this value by default.

Your WP_MEMORY_LIMIT should be set to 128M or 256M in wp-config.php whereas it’s 40M at the moment. WooCommerce (as a common example) recommend 64M minimum, so if you have many hits on the site at once especially during a scan, a lower limit here could be reached fairly easily. Your PHP memory_limit value is currently 128M so would need to be changed to 256M if you decide to pick the higher WP_MEMORY_LIMIT to accommodate this change.

After changing those, stop any currently running scans and start a new one.

Please let me know if you don’t have any luck with taking those steps.

Thanks,

Peter.

Hey @wfpeter ,

thanks for your response.

As you already expected i already had tested all steps on the link you provided.

I now implemented all steps you told me to, but i still get the same error. Here the last few lines of the scan log:

[Dec 21 13:52:33] Ajax request received to start scan.
[Dec 21 13:52:33] Entering start scan routine
[Dec 21 13:52:33] Got value from wf config maxExecutionTime: 20
[Dec 21 13:52:33] getMaxExecutionTime() returning config value: 20
[Dec 21 13:52:33] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/mtn-media.de/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=highsensitivity&cronKey=CRONKEYCENSORED
[Dec 21 13:52:33] Scan process ended after forking.

I censored the cronkey cause i do not know if that may be sensitive information.

Thanks for taking the time to help me,
Mats

EDIT: The above message pops up when i disable the cloudflare proxy on that website. When i have the proxy enabled i get this message:

[Dec 21 13:56:35] Scan engine received request.
[Dec 21 13:56:35] Verifying start request signature.
[Dec 21 13:56:35] Scan Engine Error: The signature on the request to start a scan is invalid. Please try again.
[Dec 21 14:00:22] Ajax request received to start scan.
[Dec 21 14:00:22] Entering start scan routine
[Dec 21 14:00:22] Got value from wf config maxExecutionTime: 20
[Dec 21 14:00:22] getMaxExecutionTime() returning config value: 20
[Dec 21 14:00:22] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/mtn-media.de/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=highsensitivity&cronKey=CRONKEYCENSORED
[Dec 21 14:00:23] Scan process ended after forking.
[Dec 21 14:00:25] Scan engine received request.
[Dec 21 14:00:25] Verifying start request signature.
[Dec 21 14:00:25] Fetching stored cronkey for comparison.
[Dec 21 14:00:25] Checking cronkey: CRONKEYCENSORED(expecting CRONKEYCENSORED)
[Dec 21 14:00:25] Checking saved cronkey against cronkey param
[Dec 21 14:00:25] Checking if scan is already running
[Dec 21 14:00:25] Requesting max memory
[Dec 21 14:00:25] Setting up error handling environment
[Dec 21 14:00:25] Setting up scanRunning and starting scan
[Dec 21 14:00:25] Contacting Wordfence to initiate scan
[Dec 21 14:00:25] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=KEYCENSORED&betaFeed=0&action=log_scan
[Dec 21 14:00:26] Got value from wf config maxExecutionTime: 20
[Dec 21 14:00:26] getMaxExecutionTime() returning config value: 20
[Dec 21 14:00:32] Total disk space: 673.34 GB -- Free disk space: 77.72 GB
[Dec 21 14:00:32] The disk has 79583.23 MB available
[Dec 21 14:00:32] Including files that are outside the WordPress installation in the scan.
[Dec 21 14:00:32] Getting plugin list from WordPress
[Dec 21 14:00:32] Found 28 plugins
[Dec 21 14:00:32] Getting theme list from WordPress
[Dec 21 14:00:32] Found 1 theme
[Dec 21 14:00:32] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=KEYCENSORED&betaFeed=0&action=get_known_files
[Dec 21 14:00:34] Using cached malware prefixes
[Dec 21 14:00:34] Using cached core hashes
[Dec 21 14:00:34] Indexing files for scanning
[Dec 21 14:00:34] 500 files indexed
[Dec 21 14:00:35] 1000 files indexed
[Dec 21 14:00:35] 1500 files indexed
[Dec 21 14:00:36] 2000 files indexed
[Dec 21 14:00:36] 2500 files indexed
[Dec 21 14:00:37] 3000 files indexed
[Dec 21 14:00:37] 3500 files indexed
[Dec 21 14:00:38] 4000 files indexed
[Dec 21 14:00:38] 4500 files indexed
[Dec 21 14:00:39] 5000 files indexed
[Dec 21 14:00:39] 5500 files indexed
[Dec 21 14:00:40] 6000 files indexed
[Dec 21 14:00:40] 6500 files indexed
[Dec 21 14:00:41] 7000 files indexed
[Dec 21 14:00:41] 7500 files indexed
[Dec 21 14:00:42] 8000 files indexed
[Dec 21 14:00:42] 8500 files indexed
[Dec 21 14:00:43] 9000 files indexed
[Dec 21 14:00:43] 9500 files indexed
[Dec 21 14:00:44] 10000 files indexed
[Dec 21 14:00:45] 10500 files indexed
[Dec 21 14:00:45] 11000 files indexed
[Dec 21 14:00:46] 11500 files indexed
[Dec 21 14:00:46] 12000 files indexed
[Dec 21 14:00:47] 12195 files indexed
[Dec 21 14:00:47] Forking during indexing: /var/www/vhosts/mtn-gaming.eu/mtn-media.de/wp-content/plugins/woocommerce-payments/vendor/composer/installers/src/Composer/Installers/CraftInstaller.php
[Dec 21 14:00:47] Entered fork()
[Dec 21 14:00:47] Calling startScan(true)
[Dec 21 14:00:47] Got value from wf config maxExecutionTime: 20
[Dec 21 14:00:47] getMaxExecutionTime() returning config value: 20
[Dec 21 14:00:47] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/mtn-media.de/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=highsensitivity&cronKey=CRONKEYCENSORED
[Dec 21 14:00:48] Scan process ended after forking.

EDIT2: After another scan attempt with proxy enabled i now get this message

[Dec 21 14:03:40] Ajax request received to start scan.
[Dec 21 14:03:40] Entering start scan routine
[Dec 21 14:03:40] Got value from wf config maxExecutionTime: 20
[Dec 21 14:03:40] getMaxExecutionTime() returning config value: 20
[Dec 21 14:03:40] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/mtn-media.de/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=highsensitivity&cronKey=CRONKEYCENSORED
[Dec 21 14:03:40] Scan process ended after forking.

Maybe you can help me with all this information ??
Cheers, Mats

• This reply was modified 2 years, 11 months ago by matsmtn.
• This reply was modified 2 years, 11 months ago by matsmtn.
• This reply was modified 2 years, 11 months ago by matsmtn.

Any resolution on this?

I have the same issue. I’ve gone through the same troubleshooting as Mat and still get the “Scan process ended after forking” message.

As soon as I pause Cloudflare, I am able to complete a scan.

Linda

Hi @ljezard,

As per the forum rules, we can only assist the topic starter so that similar problems with different configurations or solutions don’t become hard to follow.

However, with Cloudflare being paused to successfully complete a scan it sounds to me like you need to allow your own site access to itself:

• Login to Cloudflare
• Go to “Firewall”
• Click the “Firewall Rules” tab
• Click “Create a Firewall rule”
• Name the rule under “Rule Name”
• Set the “Field” under “When incoming requests match…” to “IP Address”
• Enter your site’s IP address under “Value”
• At the bottom, under “Then…Choose an action” change “Block” to “Allow”
• Click “Deploy

Once you have added your site to the Cloudflare Whitelist, head back over to your site and attempt another scan.

If that doesn’t fix it, please start up a new topic so we can look into your specific case. It may help to also send us a diagnostic report to wftest @ wordfence . com. You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

If you mention this in your topic we can hunt your diagnostic down and get started straight away!

Thanks,

Peter.