Aborted clients and connects

  • Resolved lottieveronica

    (@lottieveronica)


    3 years, 1 month ago

    Hi, I am trying to troubleshoot a tech issue as a non-tech person, so please bear with me on any fumbles.

    I am running into 503 errors on my websites. I have contacted my host and they tell me I have PHP requests that are running too long, not ending when the web request itself ended. And, through my rather limited knowledge and abilities, I have found two issues that may be related. I do not know if they are WordFence related, but they seem like they might be.

    I have 1.3K aborted client (The number of connections that were aborted because the client died without closing the connection properly) and 2.6K aborted connects (The number of failed attempts to connect to the MySQL server). These are likely brute force attacks. Wordfence is blocking these. I have the IP addresses added to my blocked list.

    My questions: Is it reasonable that WordFence is causing the issue with my aborted clients numbers? And, if it is the number of login attempts that are spiking my site and causing it to slow/stop, is there another way to cut off these attempts at logging in? Or am I barking up the wrong tree and need to look further into the problem?

    As an additional layer of difficulty, I have three websites under my account (all using WordFence) and I am unsure which account, or if it is all of them, has the problem.

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @lottieveronica, thanks for getting in touch.

    There could be an issue with how your site is detecting IPs, meaning that 503s are returned for legitimate visitors after Wordfence has performed a block. However, on some configurations, extra steps need to be carried out to prevent timeouts/errors while Wordfence is running due to server-side firewalls etc. I think it would be best if we took a look at some site diagnostics from all 3 of your websites to see what’s going on in your particular configuration.

    Can you send a diagnostic report from each site to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

    Thanks,

    Peter.

    Thread Starter lottieveronica

    (@lottieveronica)

    I apologize, but I am unable to follow the instructions: “You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page.”

    Where do I find this page? I do not see a tools menu… thanks.

    Lottie

    Plugin Support wfpeter

    (@wfpeter)

    Hi @lottieveronica,

    The left-hand side bar of WordPress’ administrative area will have a “Wordfence” item, which when expanded has a “Tools” link. The diagnostics option is then a tab at the top of that page.

    Here’s a screenshot of the highlighted option: https://snipboard.io/dwylvY.jpg

    Thanks,

    Peter.

    Thread Starter lottieveronica

    (@lottieveronica)

    Hi Peter, I have sent three reports, one for each website.

    Thank you,

    Lottie

    Plugin Support wfpeter

    (@wfpeter)

    Hi @lottieveronica,

    Your IP detection on all 3 sites seems good and there aren’t any communication issues I can see. To rule out any timeouts happening during scans, make sure your Wordfence > Scan > Manage Scan > Performance Options section has “Maximum execution time for each scan stage” set to 20.

    Litespeed servers require a “noabort” setting to prevent this kind of timeout also, but it seems that you’re running on Apache so I don’t believe this to be the issue either.

    It can be frustrating to see many attempts on your site such as this, especially if there seems to be no logical reason, but this is actually quite a normal occurrence.

    You might find the following blog post interesting: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/

    Wordfence, as an endpoint firewall cannot stop a bot or human from trying to visit your website altogether, but rather deal with the visits appropriately when they happen – which it looks like Wordfence is doing.

    Thanks,

    Peter.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Aborted clients and connects’ is closed to new replies.