• Resolved kashifkhawaja

    (@kashifkhawaja)


    It started around 4 hours ago. the folder in wp-content/wflogs is being updated and files are being uploaded to this folder. Here is the list of files:
    attack-data.php
    config.php
    ips.php
    rules.php

    Although i have disabled wordfence plugins and deleting this folder wflogs, it is created again. what is going on.

    • This topic was modified 6 years, 10 months ago by kashifkhawaja.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Hi @kashifkhawaja,

    Files under “/wp-content/wflogs” directory are related to the firewall configuration; the folder and files it contains will be automatically recreated as soon as a visit occurs if your Wordfence Firewall is active.

    What’s odd here is that according to your post, the Wordfence WAF should be disabled.

    Please make sure the Firewall is disabled by using the Wordfence constants as outlined here.

    Thread Starter kashifkhawaja

    (@kashifkhawaja)

    Thank you so much for replying. My hosting company told me that the folder wflogs was being accessed by different IPs simultaneously. When they removed/disabled the wordfence plugin, the IPs started targeting the wp-login.php and xmlrpc.php or they might be also accessing these files while targeting the wflog folder. Any how all of this was putting a lot of load on their server so they suspended my site until they can figure out how to fix this. I use Wordfence on almost all the website i design and build in wordpress and this was the only site behaving like this.

    I’ll update here once they update me.

    Hi @kashifkhawaja,

    I just wanted to check if your hosting provider has been able to further investigate and to provide more information on this?

    Thread Starter kashifkhawaja

    (@kashifkhawaja)

    Thank you for checking back but i had to disable and remove all traces of wordfence to bring my site back online. I am not sure but I think it was a targeted attack on wordfence. Anyways, the site is back online, no thanks to the hosting providers. (i also changed my hosting)

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘wflogs folder generating lots of traffic’ is closed to new replies.