Problems since update to 7.1.15

this is exactly what I got from 123-reg

many of my sites also small and not appropriate for VPS and/or 123-reg’s expensive scanner. it seems mad to have to pay for stuff like that when Wordfence offers a free basic scanner

@wfasa

Response back frm Heart:

Thank you for your reply and provided information.

The fact those scans are normally running for 5-15 minutes on shared hosting is enough to say this is not acceptable for the shared hosting, because it is considered as permanent and high resource usage process.

Please keep in mind that on the shared hosting platform it is allowed to use up to 5% of the resources of the whole server and running those scans is actually abusing our servers lately.

Here I will need to admit that the guys from WordFence are absolutely correct saying that on shared hosting it is absolutely normal for the scans to run slowly due to the limited resources.

If you want to see more on this I would recommend checking out wordfences docs on this here –> https://www.wordfence.com/help/scan/troubleshooting/#scan-time-limit-exceeded

They state in the URL above that limits like these are common shared hosting plans the difference with us is that we change them on the client side so you can see them, rather than limiting them on the backend and killing the processes without telling (Which is common on shared hosting). They are changes mentioned in the URL you can make to your scans to limit the resources being used which should avoid these issues. I would recommend that you disable scanning outside your wordpress install and disable “Scan images, binary, and other files as if they were executable”.

If you are able to confirm how WordFence guys tried to contact us, we can check that further.

Response from Heart

Lately we noticed that there are so many websites with WordFence plugin hosted on our servers. According to the WordFence developers those scans are normally running for 5-15 minutes on shared hosting. Sadly, this is not acceptable for our shared hosting platform, because such processes are considered as permanent and high resource usage ones. Because of the origin of the shared hosting (to host many sites on same server) our servers were suffering from high load issues because of the run of 100’s scans a day. This all caused our shared hosting platform not to offer reliable service lately.

Please keep in mind that according to out terms and conditions, on the shared hosting platform it is allowed to use up to 5% of the resources of the whole server and running those scans is actually abusing our servers lately.

This forced us to implement some changes on the shared hosting platform to restrict the time for which those scans can run to 180 seconds (3 minutes) and even if you set php.ini file to increase the PHP max execution time values, it will be disregarded.

From what I see, the WordFence scans are taking more time in cases when the website is full of content – some files in the wp-content folder and many old post, comments etc. in the database. Because of this I can say it is a good idea to try to optimize the website and remove all old content that is not being used anymore and also to optimize the wordpress database.

If you want to see more on this I would recommend checking out wordfences docs on this here –> https://www.wordfence.com/help/scan/troubleshooting/#scan-time-limit-exceeded

They state in the URL above that limits like these are common shared hosting plans the difference with us is that we change them on the client side so you can see them, rather than limiting them on the backend and killing the processes without telling (Which is common on shared hosting). They are changes mentioned in the URL you can make to your scans to limit the resources being used which should avoid these issues. I would recommend that you disable scanning outside your wordpress install and disable “Scan images, binary, and other files as if they were executable”.

Of course another workaround will be to get a VPS, where you will be able to set the restrictions on your own, but in my opinion the suggestion to try to optimize the whole website first worth trying.

I contacted them via the contact form on their website, it was the only point of contact I could find that did not require login. This was on Oct 11th.

The scan is not one process. The scan spawns new processes at the interval set in “Maximum execution time for each scan stage”. Wordfence defaults to using half of PHPs max execution time. Normally, PHPs max execution time would be set to something like 30 which means Wordfence scan processes would run for 15 seconds. Heart has set this option to 180 which means they have increased the time each individual scan process will run, rather than decrease it. To reduce resource usage, this option should be set lower, and the option to “Use low resource scanning” should be enabled.

We saw that a couple of Heart sites had PHPs max execution time set to 180. I wonder if this could have been the actual problem to begin with? It would have caused the Wordfence scan processes to run for 90 seconds, which is a bit much.

I agree that disable scanning outside your WordPress installation and disable “Scan images, binary, and other files as if they were executable” can also reduce resource usage. If the “Time limit that a scan can run in seconds” is set to 3 minutes you will not be able to complete a scan on most sites though, regardless.

Thanks for your help cucocreative. Hoping to hear from them! Would be better to have this conversation directly.

I have asked 123-reg to contact you at [email protected]

All of my sites I’ve looked at so far have max execution time set to 180 ! Seems to be set by Heart.

I just changed it back to the default (0) on one site and it now completes the scans without previous error:

[Oct 25 15:56:55:1540479415.459893:1:error] Fatal error: Maximum execution time of 30 seconds exceeded in /home/sites/businessbuilderfs.co.uk/public_html/wp-content/plugins/wordfence/lib/wordfenceScanner.php on line 367

However, it still took nearly 4 minutes

[Oct 25 16:10:44:1540480244.456991:1:info] Scan Complete. Scanned 7723 files, 15 plugins, 4 themes, 31 posts, 0 comments and 1845 URLs in 3 minutes 58 seconds.
[Oct 25 16:10:44:1540480244.455711:2:info] Wordfence used 33 MB of memory for scan. Server peak memory usage was: 112.75 MB

yes mine do too on 123-reg and you can set it to 0.. the problem is that then Heart and 123-reg reset this value to 180 overnight.. ie you can’t just leave it on automatic regular scanning

Keep in mind that there are two options that are affected.

“Maximum execution time for each scan stage” should be 15
“Time limit that a scan can run in seconds” should be 0

@wfasa

Response back from Heart:

I’ve been asked to look into this ticket. I can see that WordFence has contacted us but it was junked.

I’m going to re-open this ticket for tomorrow when I return to the office and I’ll see whether I can get someone to reply and at least get a final answer on this.

Thanks cucocreative!
Sounds promising. I’ll keep an eye out!

@wfasa

Response back from Heart:

Thanks for your patience here.

A member of our system administration team has now contacted WordFence to discuss the changes which been made and to clear some things up.

I’m going to re-open this ticket on Tuesday so I can provide some updates on these discussions.

@wfasa

Response back from Heart:

A quick update on this.

We’ve rolled back the changes which we made and are continuing to talk with WordFence on better ways to fix what we initially set out to do.

I check to see the the settings remain as I’ve set them to on one of the site the issue was occuring on.

Hi @cucocreative! We are indeed chatting with Heart now which I’m super happy about and I’m optimistic that we’ll find a solution. Thanks for the update!

Great news about the roll back, my sites seem to be scanning correctly again now.

Hope that Heart and Wordfence can find a workable solution.

Thanks guys.