Sucuri firewall and LiteSpeed

  • Resolved tsboldly

    (@tsboldly)


    3 years, 9 months ago

    Hi, we’re using LiteSpeed server with our host (Rochen) and the lscache WP plugin on a site which is sitting behind Sucuri’s web application firewall product.

    Despite there being an option in the Sucuri setup to disable their cache (which we have set), they still cache a number of file formats, include JS and CSS files. You can’t switch this off.

    Since we switched on CSS/JS minify in LSCache a couple of weeks ago, we’re finding that our pages are exhibiting the FOUC regularly throughout the day – not all the time, but enough for us to be concerned that something’s not right.

    All LSCache CSS / JS options are ON, so we’re loading async and generating CCSS, but we’ve noticed that the combined CSS / JS files are being served with a x-sucuri-cache: hit in their header, despite there being a cache-control: no-cache in the request. This tallies with what Sucuri say about always caching JS and CSS files.

    The question is, is there anything we can do LSCache-wise to help with this issue?

    I’m not finding a lot on the forums about LSCache + Sucuri, so I’m running out of ideas. Any assistance greatly appreciated!

    • This topic was modified 3 years, 9 months ago by tsboldly.
    • This topic was modified 3 years, 9 months ago by tsboldly.

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 16 total)
  • Plugin Support Cold Egg

    (@eric780217)

    Hi,

    Right, regardless of the caching level you chose, static files will be cached for 3 days even on Disabled mode. This is done to prevent certain types of DDoS attacks.

    During development, it’s recommended that you use Developer Mode to avoid caching entirely, including static files cache.

    https://docs.sucuri.net/website-firewall/performance/caching-options/#static-files

    Let us know if it helps.

    Best,
    Eric

    Thread Starter tsboldly

    (@tsboldly)

    Thanks Eric,

    Unfortunately this is a live site issue, so using Developer Mode isn’t an option.

    In the end, we switched off CCSS and async loading in LSCache which removes the issue – this impacts our performance scores a little, but not enough for us to worry about.

    We were assuming there was some interference between Sucuri and LSCache, but honestly we don’t know – I’m just aware that having multiple solutions caching can often cause issues.

    We’ll be testing LSCache 4 shortly, so may try switching these options back on to see if anything’s changed.

    Really appreciate your response, and if there’s anything concrete we find out on this I’ll post back,

    Andrew

    Plugin Support qtwrk

    (@qtwrk)

    Hi,

    have you whitelist our IPs in Sucuri ?

    https://quic.cloud/ips

    Best regards,

    Thread Starter tsboldly

    (@tsboldly)

    Hi qtwrk, thanks for the response.

    Yes, all the IPs are whitelisted – we don’t have any issues with connection to the QUIC services.

    Regards,

    Andrew

    Plugin Support qtwrk

    (@qtwrk)

    emmmm?

    could you please check , if possible, when FOUC happens , is the CCSS rule inserted into HTML header ?

    Thread Starter tsboldly

    (@tsboldly)

    This is what appears at the top of our HTML:

    https://snipboard.io/6H1Zdc.jpg

    Plugin Support qtwrk

    (@qtwrk)

    Hi,

    no, not from console, but the HTML source code

    Best regards,

    Thread Starter tsboldly

    (@tsboldly)

    This is the first line of the source code:

    https://snipboard.io/qC8YkJ.jpg

    Looks like the rules are there.

    Plugin Support qtwrk

    (@qtwrk)

    Hi,

    please try , go to Page Optm -> CSS -> Separate CCSS Cache URIs

    add / into that field , save , purge all and purge all – Critical CSS

    then regenerate the CCSS, see if it helps

    Best regards,

    Thread Starter tsboldly

    (@tsboldly)

    Thanks – I added that, purged everything, no change unfortunately.

    Plugin Support qtwrk

    (@qtwrk)

    Hi,

    you still see the CCSS rule in page’s header afterward ?

    does it happen on all of your pages ? or only few/specific pages?

    Best regards,

    Thread Starter tsboldly

    (@tsboldly)

    Hi,

    Yes the rules still appear in the header (same as before).

    This is happening on all pages.

    Thanks for your help so far!

    Plugin Support qtwrk

    (@qtwrk)

    Hi,

    okay , maybe you could try our beta test version which is pending to release, it should have fix or improvement to FOUC

    if you wish , you can get it in toolbox -> beta test -> click “master” then upgrade

    Best regards,

    Thread Starter tsboldly

    (@tsboldly)

    OK, I was planning on testing v4 anyway, so I’ll give it a go.

    Plugin Support qtwrk

    (@qtwrk)

    sure, please keep us posted how it goes

Viewing 15 replies - 1 through 15 (of 16 total)
  • The topic ‘Sucuri firewall and LiteSpeed’ is closed to new replies.