"False" IP – not related to alter statement permissions

  • Resolved mpharvey

    (@mpharvey)


    8 years, 11 months ago

    I have this plugin installed on multiple WordPress sites. All of which are identical in set up. This plugin is working on all but one. This one WP site is known to be compromised and I have cleaned files using the scan. However, live traffic does not work. All IP addresses show as “false.” Alter permissions look good and have identical settings to the other WP sites. I suspect the attacker may have changed something that is preventing IP addresses from showing, effectively preventing me from blocking them – or this is a bug? I went to the site on a different network as a test and it also shows up as “false.” Do you have any suggestions of where I could start looking? Thank you!

    https://www.ads-software.com/plugins/wordfence/

Viewing 6 replies - 1 through 6 (of 6 total)

  • Hi,

    Go to the Live Traffic page, enable the javaScript Console, and hit refresh and see if anything pops up. You may also have another plugin conflicting with Wordfence. Try disabling all plugins except Wordfence and then enable one at a time.

    Thanks!
    Brian

    Thread Starter mpharvey

    (@mpharvey)

    Thanks for the reply. This is a low traffic site, so I just disabled all plugins for a moment (except WordFence) and tried viewing Live Traffic again. All IPs are still “false.” I apologize, but I’m not 100% sure what javaScript console you’re referring to. I used developer tools in chrome and edge to view their consoles and refreshed the page. I only got a notification about CSS. Maybe this isn’t what you’re referring to, though? Could you elaborate on how I would enable the javaScript console?

    Thank you!

    Hi,

    You are on the right track. Here are instructions:

    https://docs.wordfence.com/en/Open_the_JavaScript_console_for_troubleshooting_plugins

    Check for errors.

    -Brian

    Thread Starter mpharvey

    (@mpharvey)

    I followed the instructions and the console remains blank even after a refresh.

    I previously checked mysql and it has all global privileges including alter. The mysql user on this site is also being used on another site that works fine. However, I just put a copy of wordpress 4.4 with nothing installed except WordFence and I still see “false” for the IP in live traffic. So, I’m now highly suspecting it’s in mysql and specifically with the database/privileges tied to this site.

    If this user has global alter privileges, though, what could be going on? I can’t seem to find any documentation to help me dig deeper into privileges. I found “show grants” and tried that, but I can’t seem to find any way to view any revokes this user might have.

    Thanks for all your help!

    Edit: I just created a brand new user in mysql with full privileges in an attempt to determine that the other mysql user is the problem. This brand new user also does not work on this specific wordpress site, but works on the other. So, it looks like it’s probably not tied to mysql privileges.

    It’s probably worth trying removing Wordfence and all table data and doing a clean reinstall at this point. See if the issue remains after.

    https://support.wordfence.com/support/solutions/articles/1000010321-how-can-i-remove-all-wordfence-data-or-reset-wordfence-to-the-default-settings-

    Thread Starter mpharvey

    (@mpharvey)

    That appears to have fixed the issue. Thanks for all your help!

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘"False" IP – not related to alter statement permissions’ is closed to new replies.