Wordfence is breaking my site

I’m not sure why they would think our plugin breaks file permissions. We don’t touch those. Can you ask them to be more specific? The only problem I would see is that to make sure you weren’t using more than one caching plugin (including our falcon or basic caching) at one time.

Let me know what they say. I’m really interested to see what they say. If thy can;’t explain it straight away, please ask for a supervisor to get you a more complete explanation beyond ‘Wordfence caused it’.

tim

Hi Tim,

Sorry for the delay. I never got an e-mail (unless I missed it) so I didn’t realize anyone responded until just now.

W3 Cache is having issues too (see SS), so I don’t know if that’s related – https://awesomescreenshot.com/0653u9ok67

I do have 2 cache plugins, BUT one isn’t activated, so that shouldn’t be the issue (see SS) https://awesomescreenshot.com/0d83u9p3b3

I don’t even know what a cache plugin does, which one of these 2 are better, etc. I’m just an entrepreneur.

Do you think I should delete the one that isn’t activated? Which one do you feel is better?

I’ll write to my hosting company right now to ask & then I will let you know.

Thanks

Michelle

Hi Tim,

So this is a very serious issue now. I have tested the site several times now & my hosting company is correct.

Here is what they said:

Thank you for contacting technical support. The issue with the site breaking is with wordfence. When wordfence is activated, it causes the screen to become blank, as you already know. The other two plugins, Ithemes Security and W3TC seem to work fine as long as wordfence is not activated. As to why its breaking the other two plugins, we are not sure. We do not have enough knowledge of programming the specific plugin to know the specific details, plus we do not cover it due to that lack of knowledge.

Please help.

Thanks

Michelle

Michelle

I love their level of detail. So, out of curiosity, when you disable ithemes and enable wordfence, does the site come up? How about ithemes and wordfence enabled but w3tcm disabled? The common thread I see here is that ithemes and wordfence do some of the same things and w3tc and wordfence do some of the same things., Generally speaking you want to be careful to not enable features in plugins that touch the same things. Like caching with falcon and w3tc.

I would test in the above scenarios and make sure you do not enable the falcon or basic caching of our plugin when using w3tc and then check the ithemes and wordfence options to make sure neither are touching the same things.

The other thing that could be your issue is using 3 plugins with not a lot of memory allocated in php.ini. How much did the hosting company say you had?

tim

Hi Tim,

Ok <sigh>

This has become a huge problem I have to say.

1. I tried to do what you said & when I did, I got locked out of the site. https://awesomescreenshot.com/05a3x9ow6c

Since I hadn’t really tested it to my satisfaction, after I got back in, both ithemes & WF were disabled. I activated WF & the site disappeared.

Since again it locked me out of the site, I’m now waiting for my hosting company to get me back in.

2. What I had wanted to do was test it on another theme b/c by accident they disabled the paid theme & put it back to the free one. They did this without my permission & this got me very upset so I didn’t get a chance to test it before they put it back.

I’m going to do that now & then I’ll let you know if W3tcm solves the problem. I don’t even know what that plugin is & won’t know until I go thru the themes again.

I don’t know what Falcon is. I’m sure I don’t have that plugin.

As for the memory, they said:

When first troubleshooting into the matter, your memory limit for PHP was set for 64MB. Currently your site is set to use 128MB.

Thanks

Michelle

Ok, I’m ready to tear the hair out of my head.

Something that should have taken 1-2 minutes took me 20 minutes.

Turns out W3TCM was never activated so that’s not the issue.

I got WF activated & then tried to activate ithemes which wasn’t activated.

It’s clearly NOT the theme, maybe it’s WP itself b/c every single time I tried to deactivate or activate ithemes WP would kick me out & I kept getting that error above.

I figured out if I delete the entire URL after wp- & enter in the wp-login.php that worked & I could get back in.

I deleted the cookies each & every time & it’s clear that something is really wrong b/c right now ithemes is deactivated & I can’t get the site to show up.

And I don’t even know what features inside would be the same as WF’s b/c like I mentioned, I have both working fine on other sites : (

I’m a very logical person, but I can’t figure out what is causing this : (

I hope you can make sense of this b/c it’s driving me batty.

Thanks

Michelle

P.S. Once I deactivated WF (again I went thru the booting process & having to click on deactivate twice for it to work) the site showed up.

I then activated ithemes (same issue) & the site is still live, so in the end I have to agree with them, it’s a WF issue.

Thanks

Can you post your htaccess file here?
And just to confirm you have only ithemes security installed out of the three plugins we talked about before, right?

W3TC M was a mistype of W3TC (W3 Total Cache plugin). Sorry for the confusion.

Falcon is caching that we offer and is included (but not activated)

Ithemes and WF are both security plugins so we probably both have features in common, like firewall functions. If you have two plugins that both limit login attempts from invalid usernames, for example, it can cause a problem because 2 things are trying to direct the behavior of the same function.

One thing I noticed is that you said something about the login url. I know we don’t change that. I think iThemes does though.

So if you can send me your htaccess file and confirm that ithemes is only plugin you have activated that would be great.

tim

Hi,

Ok, so the booting has stopped. My hosting company did something, they never got booted & when I tried deactivating & activating, it stopped.

Yes, right now only ithemes is activated. WF & W3TC isn’t.

Here’s a SS – https://awesomescreenshot.com/0043xg3qa5

No, I’m not saying WF changed the login URL, what I’m saying is that when I was getting booted there was a link (see SS) to try again (logging in) & whenever I clicked on it, the URL wasn’t the normal https://www.domain.com/wp-login.php It was a VERY long URL so I’d have to delete it & enter in the correct URL.

I understand what you are saying about ithemes & WF having the same features, but again, I have both on all my other sites, so unless those sites are configured differently (we are talking at least 24), they aren’t having issues.

As soon as I get the htaccess file I’ll post it here.

Thanks

Here it is. I with there was an attach feature here.

https://www.dropbox.com/sh/56404xqbheyvvgj/AAC3vmi8YnOOMA3leSdxrl6wa?dl=0

Thanks

Hello?

Ok This is weird but I totally responded to this a day ago.

The htaccess file link shows a 404 error.

Something else that would be extremely helpful would be to see error logs for your site pertaining to a time when wordfence was on. Like wait until the middle of the night and turn it on for 5 minutes and note the exact time. The request those logs from your hosting provider.

tim

I’ll bet you dollars to donuts if she just deletes the other plug in, probably wordfence also and does a fresh install of wordfence and activates it, the problem will be solved.

the problem isnt that it is deactivated. the problem is likely because at some point it was activated, and hence the plug in scripts are still in place blocking wf from functioning properly.

Sorry for the delay, since nothing is working I am hiring someone to look into this.

Nope, I had my hoster reinstall WP & that didn’t solve the problem, nor deleting WF & reinstalling it didn’t solve the problem either.

Thanks

Ok, so…

My own website coder took at look at the problem & he DEFINITELY feels it’s a WordFence issue.

He went through all the plugins & deactivated ones he thought may be causing the problem & the site still doesn’t show up.

He also deactivated ithemes & that isn’t the issue b/c it still doesn’t show up. The ONLY time the site shows up is when WF is deactivated.

One thing he did notice which no one mentioned before is that the site DOES show up when you are logged in as an admin. Why I have no idea.

But now that I realize that WordFence does NOT find all malicious code, I will be looking for another piece of software as WordFence just doesn’t do a proper job.

The malicious code on another blog was never found & it’s been there on the site since 2010.