Missing data in critical email alerts

Update

the new alert email has a whole paragraph removed – crudely, with some words cut in half.

Can you please advise ASAP how to restore the IP address in my user signing email alerts – it is a critical element of your plugin’s security.

I am seeing the same thing. The notification emails today about the upgrade to 7.1.11 just have a URL to stop receiving alerts if I am no longer an admin on the site. No other info at all.

Notifiations about admin things like upgrades don’t include IP – there is n o third party involved.

I’m talking about notifications about a user signinig in to my website with admin access. THAT is serious and important (in case it wasn’t me) and needs to include the IP address and location of that user.

I agree. I think there is something broken with their mail function. A few of the upgrade notifications that I received for some of my sites were complete. Other’s were not. Whatever function is building outbound emails is not working properly.

ok – let’s wait for the reply from the plugin developers. Apparently they answer questions here within 24 hrs.

which have already passed.

Hello Wordfence?!?…

I have contacted the developer directly via email – they have replied saying nothing has changed, the code is the same and so the problem must be in my website.

But if other users have the same issue – how can it be?

They asked that I check the PHP error logs. Ok, I will as this is most unusual error.

I haven’t downloaded any new plugins in the past few weeks that could interfere with my wordfence emails, haven’t changed anything other than upgrading WP to the current version. So…the mystery continues (until resolved).

Hi!
As magicpowers stated above we’d love to have a look at error logs from one of these sites to see if we can find any information about what’s going on.

Nothing has changed in this specific code recently but it’s possible that something else has changed. The part that seems to be missing is the part that requires an IP and hostname lookup.

If you are able to find your PHP error logs, please email them to [email protected] or post the last few lines from them here in the forum. You can redact any identifying information such as your hosting account name.

Thanks in advance!

Hi wfasa

Both my theme developer and my website host advised they have nothing to do with these email changes. I will still check my php error logs but in the meantime I have two more questions and some important additional information.

1. You said you are of course using WF on your computer system and are also receiving these alert emails. Have those emails following your signin in the past couple of weeks included your IP address or not?

2. My internet security program (Bitdefender) offers a VPN browsing option which:
“helps you keep your real IP address private, which lifts any location restrictions while your whereabouts and browsing habits remain anonymous”. I don’t use it, but if others do, is it possible that their VPN blocks their IP address from WF?

I have sent the examples of those different email alerts to the engineers of my website host – one of the best out there (Siteground) – and here is their advice:

“I have checked and the ENTIRE e-mail structure has been changed. This is beyond a sever level edit of the message from what I am able to see. The entire template which your plugin uses seems to be altered which is why the IP is not visible. We would suggest reinstalling the plugin or insisting that the plugin developer checks on this for you. We have not encountered this issue before.”

As I mentioned earlier, this issue came up after the last update of WF.
Would re-installing the plugin help, and if so, how can Ido it safely?

I would appreciate your advice.

Hi @magicpowers

1. We have a whole fleet of test sites where we run Wordfence and we have 2 million customers who alert us to any issues on their sites. This is definitely not happening on all sites.

2. No I don’t see how that’s possible. The IP is fetched on the backend, Bitdefender runs on your computer which is a wholly different system.

You can definitely try reinstalling the plugin. All you do is remove the “wordfence” folder in wp-content/plugins then reinstall it from the WordPress plugins page. All your Wordfence data is stored in the database, so options will remain intact.

It’s theoretically possible that a file could be corrupt but it seems odd two people would be seeing the same thing there. @nelson2a are you also on SiteGround?

Thanks!

I am not. My symptoms are a little bit different though which is why I suspect an issue with the way the emails are being composed. Some (but not all) of the notifications that I received for the upgrade to 7.1.11 look like this:
Subject:[Wordfence Alert] https://www.MYSITENAME.com Wordfence Upgraded to version 7.1.11
Body:
________________________________________________________
No longer an administrator for this site? Click here to stop receiving security alerts: https://www.MYSITENAME.com/?_wfsf=removeAlertEmail&jwt=eyJhbGciOsfgsdfgsdfgsInR5cCI6dfgsdfgCJ9.eyJlbWFpsdfgsdfgsdfgdsfWxzb25ldC5uZXQiLCJadgadfgadfgfQ.-S8Q2WT3fdfgdfgafgadfghshgVtBFjqVZkpM
________________________________________________________

Normally (and on some of the emails for this upgrade) they look like this:
Body:
________________________________________________________
This email was sent from your website “MYSITENAME” by the Wordfence plugin at Tuesday 21st of August 2018 at 07:17:19 PM
The Wordfence administrative URL for this site is: https://www.MYSITENAME.com/wp-admin/admin.php?page=Wordfence
Your Wordfence installation has been upgraded to version 7.1.11
User IP: 127.0.0.1
User hostname: localhost

NOTE: You are using the free version of Wordfence. Upgrade today:
– Receive real-time Firewall and Scan engine rule updates for protection as threats emerge
– Real-time IP Blacklist blocks the most malicious IPs from accessing your site
– Country blocking
– Two factor authentication
– IP reputation monitoring
– Advanced comment spam filter
– Schedule scans to run more frequently and at optimal times
– Access to Premium Support
– Discounts for multi-license purchases

Click here to upgrade to Wordfence Premium:
https://www.wordfence.com/zz1/wordfence-signup/
—
To change your alert options for Wordfence, visit:
https://www.MYSITENAME.com/wp-admin/admin.php?page=Wordfence&subpage=global_options
To see current Wordfence alerts, visit:
https://www.MYSITENAME.com/wp-admin/admin.php?page=Wordfence

No longer an administrator for this site? Click here to stop receiving security alerts: https://www.MYSITENAME.com/?_wfsf=removeAlertEmail&jwt=eyJhbGcsfgdsgfgsdfgsdfgIkpXVCJ9.eyJlbWsdfgsdfgsdfgb25ldC5uZXQiLCJfZXhwIjsdfgsdfgsdfg5fQ.42aFZ0jgju0EgYZ_ynqHySrsdfgsdfgsdfgFPXO8Q
________________________________________________________

So the bulk of the message seems to be getting stripped off on some of the emails.

Other users are reporting this same problem here: https://www.ads-software.com/support/topic/email-received-no-longer-an-administrator-for-this-site/

Many thanks for checking in to this!

thanks wfasa and nelson2a for your comments.

I think this is the clue – a part of the email text is stripped off, rather than the specific data such as IP address.
If it was the IP address, that would be the only part missing in my emails.
However, the next sentence right below the IP address is also missing leaving the last letter of the last word of the missing part in!. This indicates that the stripping is random and crude rather than targeted.

I will reinstall WF and if that doens’t help I will review and send you the error logs.

Finally – after checking php error logs, all the settings, updating WF to curent version, consulting with my web host and theme developer, testing and more testing – the problem is SOLVED.

How? I have simply re-installed WF.

There must have been corrupted files which were deleted before a new clean install.

Sometimes the simplest solutions are the most effective ??

Hi @magicpowers,
Happy to hear it was resolved by reinstalling.

@nelson2a,
Can you try reinstalling as well to see if that fixes your issue? Your emails are also getting cut off where an IP address would have been processed by a specific function so you may still be suffering from a similar issue.

Hi @wfasa

Unfortunately. my joy was short-lived.

I have logged on just now to my website – and the email alert I have received contains the same error – the user IP address details together with the following sentence are STRIPPED OFF.

So what do I do now? Could you please review the data I have sent you if you still have it and advise why this is still happening and why it fixed itself just once.

very disappointed.

• This reply was modified 6 years, 6 months ago by magicpowers.

Hi @magicpowers!

Sorry to hear that. Your error log also shows problems connecting to the database. Those errors are coming from a function called wsBrokenLinkChecker->database_maintenance. That seems to be part of the “Broken Links” plugin https://www.ads-software.com/support/plugin/broken-link-checker/

There is some chatter in that plugins support forum about it not being compatible with newer PHP versions and the plugin hasn’t been updated for more than a year. So even though I’m not convinced it’s directly related to your Wordfence email problem, I would recommend removing that plugin.

The only thing in your error log which is related to Wordfence is a notice from file_get_contents about not being able to find a file. This is part of the Wordfence scanner function that allows you to delete infected files. So the error is not directly related to the email problem.

Are you deleting files via the Wordfence scanner? If so, is it possible that you are deleting a Wordfence file by accident while doing that? If reinstalling Wordfence worked and now it’s broken again, something must have happened to Wordfence files in the meantime.