Existing malcare-waf.php

Hi @jv_oz, thanks for reaching out to us.

The file you mention (malcare-waf.php) refers to an alternative security plugin called Malcare. We’ve seen sites at Cloudways with Malcare as they provide it as part of some hosting packages.

If you wanted to leave Malcare installed, the INCLUDE option in our WAF optimization wizard should override the Malcare auto_prepend_file value so that our wordfence-waf.php file would then include malcare-waf.php. You may need to consult with your host if you wish to safely remove the plugin altogether though in case there are any unforeseen effects.

Just as a note, there may be overlapping features when running two security plugins concurrently that can cause performance issues if both are scanning for the same vulnerabilities or checking the same files concurrently, so it would be advised to choose your preferred security plugin option and stick with that going forward.

Let me know how you get on!

Thanks,

Peter.

Hi Peter. We don’t have any plugin called Malcare on our site, so I don’t know what that malcare-waf.php is doing there (unless it had been installed previously and then removed). What happens if we just go ahead and activate the Wordfence Firewall?

Hi @jv_oz,

As Malcare is a product that has been known to be installed by your host in the past, I am not immediately concerned at the presence of the malcare-waf.php itself. It’s hard for sure to know whether this has since been removed in maintenance by you (or another admin if you have any), or by the host.

You should be able to go ahead to activate/optimize the Wordfence firewall without issue, despite the presence of the Malcare file.

It may be worth checking in with your hosts’ support channels just to confirm whether you can obtain any more information about the Malcare installation and whether they have decided to remove it from customer sites without fully cleaning up the files associated with it. You could also check your WordPress > Plugins > Installed Plugins and selecting “Must Use” from the filters near the top and see if it appears there.

Thanks again,

Peter.

Hi @wfpeter

I have the same issue. I migrated my website to Cloudways and Malcare plugin was automatically installed but I prefer to use Wordfence. When trying to set up the firewall, I get the same message:

To make your site as secure as possible, the Wordfence Web Application Firewall is designed to run via a PHP setting called auto_prepend_file, which ensures it runs before any potentially vulnerable code runs. This PHP setting is currently in use, and is including this file:
/home/644278.cloudwaysapps.com/vtjxwqvzfy/public_html/malcare-waf.php

I already deleted Malcare plugin. Is it safe to select the OVERWRITE option?