Optimize Wordfence Firewall with PHP-FPM

Hi @azzepis,

I’m not seeing the auto_prepend_file value from your screenshot being acknowledged in your site diagnostics. Sometimes, ini files in locatons like the /etc/php/7.4/fpm/conf.d directory can reset the user_ini.filename to an empty value. You may need to consult your host about this if you don’t have access to this location.

On some servers, you could use FTP or a file manager to access your .htaccess file in the root directory and make sure this code is input:

# Wordfence WAF
<Files ".user.ini">
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
</Files>
# END Wordfence WAF

Then also, in the same directory, edit your .user.ini file with this code:

; Wordfence WAF
auto_prepend_file = '/your/path/to/wordfence-waf.php'
; END Wordfence WAF

Make sure to change the path above with the one where wordfence-waf.php actually resides.

There is some more information around adding this code and how to manually optimize the firewall here: https://www.wordfence.com/help/firewall/optimizing-the-firewall/#firewall-optimization-setup

Let me know what you find out!

Peter.

I created test.php in the root of my website (same folder where .user.ini, wp-config.php, wordfence-waf.php and wp-content folder are located) with next code:

<?php
echo phpinfo();

I opened that file in the browser like https://mydomain.com/test.php and made Screenshot provided in the first message.

So there is no sense to check any settings or files, as I understand, because this file shows final php settings that is active for my site.
So auto_prepend_file option is filled correctly but wordfence does not see that

Thank you

Is there anything I can try to solve this?

Hi @azzepis,

I searched for your screenshot of your phpinfo(); output but was unable to find Dmytro or azzepis referenced in any emails we’ve received in this timeframe so apologies for the late message.

If auto_prepend_file is still being seen by PHP, but not reflected in your site diagnostics please let me know and try sending the details again with your forum username included – just let me know here when you have done so I can look for them.

Thanks,

Peter.

Hi, thanks for your answer.
I sent report again (screenshot https://i.imgur.com/7mce0JX.jpg)

Here is one more time screenshot of phpinfo https://i.imgur.com/ZRJXzgU.jpg