wflandon

Hi yossarian04,

What port(s) are the noc3.wordfence.com calls being made? Knowing that might help us troubleshoot.

For general database load, I would try playing with the “Update interval in seconds (2 is default)” setting, toward the bottom of the Wordfence Options page, and see if that helps any.

Let me know.

I forgot to ask what you have the “Maximum email alerts to send per hour” set to on the Wordfence Options page. That is the first thing to check. In your case that should be set to 0 if you want to receive all alerts. I will still check with the dev team and see what they say.

Hi creatura85,

I might temporarily change the email address and see if that does anything. I will check with the development team and see if this is functioning as intended. It very well could be. I know that the amount of emails sent / received during a small window of time is viewed negatively by spam filters.

Let me know what you find out and I will get you an update when I hear back from the team.

Thanks TheRealMikeD. And thanks for the info. That always helps us out.

Glad it’s working for you now!

Hi netsector,

I would check the paths of files in the site root, like user.ini, php.ini, and wordfence-waf.php. Those paths are sometimes hardcoded because of the way servers handle them. Hopefully you can find the culprit pretty quickly. Let me know.

Hi Stephen,

I believe Wordfence has a fall back if curl is disabled. So I do not think you are blocking an important process. It is probably throwing a warning about curl being disabled and that is what you are seeing. However, I will check with the development team to verify that.

Slider Revolution has had a few vulnerabilities over the last few years, if that is the plugin you are referring to, so the exploit very well could have been related to that plugin.

References: https://www.exploit-db.com/exploits/35385/ and https://www.wordfence.com/blog/2016/04/mossack-fonseca-breach-vulnerable-slider-revolution/

Hi pcmobitech,

It should not be a problem using a CDN with the Wordfence Flacon engine. We have not had any reports of it not working. Just keep an eye on it, and let us know if you run into any issues.

Hi mountainguy2,

I would say that the Wordfence scan itself is mainly reactive. But the Wordfence team is very proactive! We are constantly looking for vulnerabilities throughout all wordpress plugins and themes. The Wordfence team finds many vulnerabilities before anyone else! And since the scan is actually connecting to the Wordfence servers to retrieve malware patterns, I would say there is a very proactive element to it.

You can check out the blog to see some examples of vulnerabilities the team finds.

https://www.wordfence.com/blog/

Hi Asle,

Thanks for the info. I will pass this on to the development team.

At the bottom of the Wordfence Diagnostics page, check “Enable debugging mode” and re-run the scan. Paste the last 20 lines or so in the thread. Make sure you remove any sensitive information! Then we will check it out and go from there.

I do not think it was Wordfence. It was most likely easycaptcha if renaming the plugin’s directory allowed access.

If a script changed your .htaccess file, that could be an indication of something mischievous going on. However, some plugins do change the .htaccess file to create some kind of check or a change in functionality. If Wordfence scans are not finding anything out of the ordinary, you are probably OK.

I am glad you found a solution to your lock out problem!

Hi stagiar,

What options have you tried enabling / disabling in Wordfence? If the Wordfence firewall is turned on, it is possible, but unlikely, that it is blocking some File Away functionality. Try temporarily turning off the firewall portion of Wordfence and see if that makes any difference. There are no known issues between File Away and Wordfence that I am aware of. However, you should also try posting on the File Away forum as they might have more information on this issue.

Hi jen697,

Sorry to hear you are having issues. Out of curiosity, what are you using to view the cron jobs and resource usage?

Wordfence normally uses less than 100MB of memory. So if it is the only wordpress job running at the time then it should be investigated further. However, if it is running at the same time as other high resource jobs, that could also be the problem.

Toward the bottom of the Wordfence Options page what are the values set for “How much memory should Wordfence request when scanning” and “Maximum execution time for each scan stage”?

If you go to the bottom of the Wordfence Diagnostics page, and click the “Test your WordPress host’s available memory”, what are the results?

Hi justdave,

I do not believe that is currently possible. However, I will forward this a long to the team as a feature request.

Hi zamano,

Have you checked spam? Occasionally these types of emails end up in spam. And every now and then they are filtered out completely before getting to you.

I might try temporarily changing the email address to a different provider, than the one you currently use, and see if you receive the alerts. If you do, its possible that the emails are sending correctly but being filtered out before they even get to you.

Let me know what you find out.