Wordfence email reports are wrong

@rlweiner,

First off I wanted to thank you for your patience in receiving a reply.

There are a couple things that I’d like to get more information on from you to help diagnose the issue. Is it possible you have an older site with Wordfence installed that is running an older version of the plugin? Can you send a copy of the actual email to stevenr[at]wordfence[dot]com?

If there are no older sites and the email is originating from an active site, go to the <i>Wordfence > tools > diagnostics</i> page and send a copy of the diagnostics report to the same email address listed above. This will let us dig deeper into the root cause of the issue.

Thanks,
Steve

Thanks, Steven. I’m on the current version of WP and all my plug-ins are up-to-date. I’ll email you.

@rlweiner,
Thanks for sending those logs. There are a couple things I noticed after looking at the logs you are using an older version of Wordfence. Can you upgrade to our latest 7.1.7 release and run an email report to let us know if that resolves the issue for you.

Also, do you know if your site setup uses multiple databases? If it does, it’s possible that when the email reports are generated, the data pulled is from a stale database and not the current database.

Awaiting your response,
Steve

@rlweiner,

Thanks for sending the latest email report. Do you recall if there is an uncompressed site stored on the server? If so, connect via FTP/SSH and rename the Wordfence folder found in wp-content/plugins in the UNCOMPRESSED backup folder. What’s I’m thinking is there may be another backup that is emailing the reports, and since it’s not an active site, the reports would contain no data.

Let me know your findings.

Thanks,
Steve

Hi Steve. Per my email on 6/14, I only have 1 database. I ran a search for “wordfence” and see 4 matching directories:
/public_html/wp-content/plugins/wordfence/
/public_html/wp-content/plugins/wordfence/vendor/wordfence/
/www/wp-content/plugins/wordfence/
/www/wp-content/plugins/wordfence/vendor/wordfence/

The latter two appear to be aliases of the first 2.

Hi @rlweiner!

Just wanted to check in here. I agree with Steve that this would most likely be happening because the emails are being sent from a different site than the one you are looking at.

All the plugins that were mentioned in the email you received, were they up to date on the site or were they out of date?

I’m also curious to hear if updating to the latest version of Wordfence may have fixed the issue.

Thanks!

The problem is still a problem. ?? I’m getting one report that’s correct and one that’s all wrong. The wrong one shows that all of my plugins are out of date when they’re actually all current. It also shows no incidents during the previous week — I wish that was true.

I’m planning to find some time during off hours and rename the duplicate directories:
/www/wp-content/plugins/wordfence/
/www/wp-content/plugins/wordfence/vendor/wordfence/
to see if that fixes the problem and doesn’t break my site.

Hi again,
I don’t think the folder aliases should be the reason this is happening. There has to be a copy of the site somewhere, where the plugins are actually out of date. No other explanation really makes sense.

Can you please forward me both of those reports, the latest versions? I’d like to compare them directly to each other. If you can include the email headers, that would give me definitive proof of what’s going on. If you are using gmail you can find the email headers by clicking “Show original” in the drop down that displays when you click the arrow on the right hand side of the message. Other email programs typically have similar functions called “show details” or “show headers”. Send both emails with headers to [email protected]. That would be great.

Thanks!