thanks!
ok followed the process.
as a weird aside, with the checkboxes Wordfence only shows me checked boxes, if they are not checked they are literally empty blank spaces, not little circles.
the “Show log” doesn’t go back 20 entries, I had to hit “show full log for that”
here’s what “show log” showed
[Apr 13 13:35:19] Entered fork()
[Apr 13 13:35:19] Calling startScan(true)
[Apr 13 13:35:19] Got value from wf config maxExecutionTime: 20
[Apr 13 13:35:19] getMaxExecutionTime() returning config value: 20
[Apr 13 13:35:19] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/www.14850.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=bb9e81cb904d60533a43fbf99d84b728
[Apr 13 13:35:20] Scan process ended after forking.
FULL LOG last 20
[Apr 13 13:35:20:1555176920.855069:4:info] Scan process ended after forking.
[Apr 13 13:35:19:1555176919.849329:4:info] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/www.14850.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=1&scanMode=standard&cronKey=bb9e81cb904d60533a43fbf99d84b728
[Apr 13 13:35:19:1555176919.848252:4:info] getMaxExecutionTime() returning config value: 20
[Apr 13 13:35:19:1555176919.847805:4:info] Got value from wf config maxExecutionTime: 20
[Apr 13 13:35:19:1555176919.847326:4:info] Calling startScan(true)
[Apr 13 13:35:19:1555176919.713096:4:info] Entered fork()
[Apr 13 13:35:19:1555176919.712676:4:info] Forking during hash scan to ensure continuity.
[Apr 13 13:35:19:1555176919.710519:4:info] Finalizing malware scan results
[Apr 13 13:35:19:1555176919.700044:2:info] Done URL check.
[Apr 13 13:35:18:1555176918.780200:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=00f6261f2f4e59122bf9b647f0f349770c2f4a2f2c31d6d9f2d14704eded900add146e6d823850915a854acec420e2e4b08262474a444f3a54766666d4089d5d&s=eyJ3cCI6IjUuMS4xIiwid2YiOiI3LjIuNCIsIm1zIjpmYWxzZSwiaCI6Imh0dHA6XC9cL3d3dy4xNDg1MC5jb20iLCJzc2x2IjoyNjg0NDM5NTEsInB2IjoiNS42LjQwIiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy42NC4wIiwiY3MiOiJPcGVuU1NMXC8xLjAuMnIiLCJzdiI6IkFwYWNoZSIsImR2IjoiNS42LjQxLTg0LjEifQ&betaFeed=0&action=check_bad_urls
[Apr 13 13:35:18:1555176918.778981:2:info] Checking 33 URLs from 27 sources.
[Apr 13 13:35:18:1555176918.756867:2:info] Done host key check.
[Apr 13 13:35:11:1555176911.043582:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=00f6261f2f4e59122bf9b647f0f349770c2f4a2f2c31d6d9f2d14704eded900add146e6d823850915a854acec420e2e4b08262474a444f3a54766666d4089d5d&s=eyJ3cCI6IjUuMS4xIiwid2YiOiI3LjIuNCIsIm1zIjpmYWxzZSwiaCI6Imh0dHA6XC9cL3d3dy4xNDg1MC5jb20iLCJzc2x2IjoyNjg0NDM5NTEsInB2IjoiNS42LjQwIiwicHQiOiJjZ2ktZmNnaSIsImN2IjoiNy42NC4wIiwiY3MiOiJPcGVuU1NMXC8xLjAuMnIiLCJzdiI6IkFwYWNoZSIsImR2IjoiNS42LjQxLTg0LjEifQ&betaFeed=0&action=check_host_keys
[Apr 13 13:35:11:1555176911.042557:2:info] Checking 6812 host keys against Wordfence scanning servers.
[Apr 13 13:35:10:1555176910.953162:4:info] Using MySQLi directly.
[Apr 13 13:35:10:1555176910.952621:4:info] Gathering host keys.
[Apr 13 13:35:10:1555176910.952117:2:info] Asking Wordfence to check URLs against malware list.
[Apr 13 13:35:10:1555176910.951581:2:info] Scanned contents of 3829 additional files at 7.40 per second
[Apr 13 13:35:10:1555176910.950765:4:info] No files remaining for malware scan.