sandbox2800

@wfpeter

Apparently my reply didn’t post the other day.
I understand the GeoIP could be different so I didn’t give that much thought. It was when my IP was listed as blocked that I actually questioned what is being blocked.

For “Amount of time a user is locked out” I’m set at 1 day.
For “How long is an IP address blocked when it breaks a rule” I’m set at 2 hours.
For “Live Traffic” and the reason it was blocked is 100% due to scan I ran. It logged as a bot.

None of those answer the original question though. So the bot scan I did, blocked my IP because of the malicious scan, it should have been blocked for anywhere from 2 hrs to 1 day depending on what setting it falls under. However, it wasn’t blocked, at all! I was logged in at the time of the scan and even logged out within a couple minutes of the scan to test logging back in.

At the end of the day, the dashboard “claims” to have blocked my IP address but I had full access to the website, admin dashboard, and any other aspect of the page. SO what does it really block? Seems to me it is more of a false sense of security.

Also when that append file line is added to .htaccess, it gives me an internal server error.

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at webmaster@localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error log.

@wfpeter

A couple of places where I’m not following along. I’m not sure if you are saying do this or that or this and that.

For example:

but I think the?auto_prepend_file?directive pointing to wordfence-waf.php should be placed in?.htaccess?or?.user.ini?on your setup if the?php.ini?file can’t be found in?/usr/local/etc/php

Should that line be placed in .htaccess OR user.ini and only IF the php.ini can’t be found in /usr/local/etc/php?

I placed it in .htaccess but do not have a user.ini. I also could not locate php.ini in /usr/local/etc/php but did find php.ini-development and php.ini-production.

As mentioned above I did add the auto_prepend_file line to my .htaccess but in regards to:

?If?wordfence-waf.php?was never created in the root of your site either, you can create it manually and fill it with the 8 line example that includes MySQLi on the following page:?https://www.wordfence.com/help/firewall/mysqli-storage-engine/

wordfence-waf.php was created in my root however it is slightly different than the exampled linked.

<?php
// Before removing this file, please verify the PHP ini setting auto_prepend_file does not point to this.

if (file_exists(DIR.'/wp-content/plugins/wordfence/waf/bootstrap.php')) {
define("WFWAF_LOG_PATH", DIR.'/wp-content/wflogs/');
include_once DIR.'/wp-content/plugins/wordfence/waf/bootstrap.php';
}

I do not have this line, from the example. My site is running a mariadb instance.

define('WFWAF_STORAGE_ENGINE', 'mysqli');

@wfpeter,

The diagnostic report has been sent. Thank you for taking some time to look into my situation.

My firewall is now enabled and protecting (no longer learning) but it still is not optimized. I’m not sure what else to try and fix the optimizated.

I’ve considered going premium but if the plugin won’t work with my setup, there’s little motivation.

Peter,

Thanks for the response. I have ran up and down those troubleshooting guides an unknown amount of times.

I thought I put it in my original post but apparently I have not. I am self hosting on a Synology.

With the help of ChatGPT (I know not the best option), I thought I found the php.ini and made the edit from the manual configuration but I’m still prompted to optimize.

@pss1152

Did you ever find a solution to this.