Web Application Firewall is disabled

Hi,
And please tell me about the errors/message that are showing in the admin – https://prnt.sc/f-sN2Zr97t7x

Hi @hemasusi, thanks for reaching out to us with lots of detail around your problem.

With the wflogs folder and the configuration file being unwritable, the solution would certainly be allowing this. I have seen WordPress recommend having your core folders set to 755 permissions so do that if you haven’t already. You can check current database and filesystem permissions status on the Wordfence > Tools > Diagnostics page. If you’re unsure about, or uncomfortable, making changes in this area your hosting provider should be able to assist.

I’ve seen customers using Google App Engine having a similar issue. Usually .htaccess would need to be writeable for Wordfence, but as Google App Engine uses app.yaml instead, this may not be automated when optimizing the firewall. However, you can change the WAF log file location by defining WFWAF_LOG_PATH in wordfence-waf.php if the WAF will be optimized, or it can be defined in wp-config.php if you are only running it in WordPress. If your site can’t write to the web root, you’ll also need to create wordfence-waf.php there manually.

A typical wordfence-waf.php looks like this (WFWAF_LOG_PATH defined here can be changed to any writable location):

<?php
// Before removing this file, please verify the PHP ini setting <code>auto_prepend_file</code> does not point to this.
if( ! defined('WFWAF_STORAGE_ENGINE')) { define('WFWAF_STORAGE_ENGINE', 'mysqli'); }

if (file_exists(__DIR__ . '/wp-content/plugins/wordfence/waf/bootstrap.php')) {
	define("WFWAF_LOG_PATH", __DIR__ . '/wp-content/wflogs/');
	include_once __DIR__ . '/wp-content/plugins/wordfence/waf/bootstrap.php';
}

If this is the case, our logs will also need to be changed to MySQLi rather than a physical file.

The notice about WooCommerce integration can be dismissed, but take note of enabling this feature in Login Security > Settings if you’re going to be adding 2FA/reCAPTCHA (or both) to your site.

Thanks,

Peter.

Hi @wfpeter,

Thanks for your info. I updated the permission setup. Now its working.

Please check these screenshots-

https://prnt.sc/newRR9MJEEgA

https://prnt.sc/_msb5w8HL8H-

https://prnt.sc/7_k7dilJUHV-

May i know the seriousness of these kind of emails?

Hi @wfpeter and WF team,

We have successfully activated WordFence in our dev/test/live sites using our server pantheon’s documentation – https://pantheon.io/docs/plugins-known-issues/#wordfence

Now seen below errors in all env. https://prnt.sc/7Lp90X6Q3b4K

[10-Feb-2023 12:42:03 UTC] PHP Warning: fopen(/code/wp-content/wflogs/rules.php): failed to open stream: No such file or directory in /code/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/waf.php on line 332

[10-Feb-2023 12:42:03 UTC] PHP Warning: include(/code/wp-content/wflogs/rules.php): failed to open stream: No such file or directory in /code/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/waf.php on line 335

Once i seen this in TEST env, i ignored it because that is the warning we can safely ignore as per their documentation – https://prnt.sc/FR1cOrphLbKQ

Now i am curious about this error in production. Do we need to do anything?

Kindly assist, because this is in production.

Our PROD URL – https://statueofliberty.org/