Wordfence (6.0.6)completely borked my site

Are you running more than one caching plugin? What you are describing is when two plugins run gzip browser caching. The page is essentially gzipped twice but a visitors browser unzips it once. Disable Falcon or the other caching, clear the cache, and see if that does not fix the issue.

tim

Thank you. But I’m not running any other caching–unless you consider Cloudflare to be caching. I’m not sure how to disable Falcon since I don’t think I ever enabled it.

Problem is, if I even activate Wordfence, my site will completely bork. So I don’t can’t even get into the WF options without activating it.

The caching may be at the server level from your hosting company. Since you seem to have settings there that have caused a problem I would advise a complete reinstall of the plugin.

This will remove all settings too so if you want, export them (options page at bottom) and save the provided key so you can import them later.
On the options page select the option (near bottom) that says “Delete Wordfence tables and data on deactivation?”
Uninstall normally through wordpress admin
FTP to your webserver and ensure that there is no wordfence folder in the plugins folder
If you have database access verify that the wordfence tables are removed. (all ours have wf in the title – like wp_wfBlocks for example
Reinstall wordfence from the wordpress admin
Try a new scan.
You can Import the old settings now if you exported them before, but I would suggest starting fresh since you don’t know what was tweaked.

tim

Thank you. Sounds like a lot of steps! I will take a deep breath and try. I’d just hate to go through another 2 days like the last 2 where I was struggling to troubleshoot this borking issue by reactivating the plugin. Here’s hoping!

Let me know what happens.

tim

I will, but haven’t quite gotten up the nerve to try it. But I wanted to share the note that I just got from my web host in case it shed any light that you can understand.

Other than Opcache, a caching feature of the PHP scripting language, there are no server side caching features on the server. I’m not sure if Opcache may interfere and cause the issue to happen, so I’ve disabled it just in case. It can be enabled/disabled by clicking on PHP Version in CPanel, then choosing to enable or disable Opcache. I did check to see if GZip was enabled and it is not. However, loading your site and checking for GZip shows that GZip is enabled. Either another plugin or the theme must be causing GZip to be enabled. That would explain the interferance, as well as why testing for GZip here shows that it’s enabled: https://www.gidnetwork.com/tools/gzip-test.php

Ahh. I bet the theme has it. This comes as a bundled feature. Look at the sales page for things like “Enhanced performance”, etc. If you follow the steps I gave you that will remove anything we have added. There may be a folder in wp-content called wfcache that can be removed, if it is not automatically. Also check the htaccess file. Sometimes erver restrictions won’t let you overwrite it so there may be code there. Usually it is much easier than this but I am trying to let you know all the possible things to check now.

tim

I just heard back from theme support (Headway Themes) that they do have gzip enabled but that I can turn it off if I want to.

The thing that still puzzles me is why did it happen all of a sudden? And why isn’t the same thing happening to about 10 other sites that I have on Wordfence that are also running on this host?
Here are the plugins that are active on this site. Do any of them raise a flag for conflict?
ACTIVE PLUGINS:
Ajax Event Calendar 1.0.4
https://www.ads-software.com/extend/plugins/ajax-event-calendar/

Anti-spam 3.5
https://www.ads-software.com/plugins/anti-spam/

Auto ThickBox Plus 1.9
https://attosoft.info/en/blog/auto-thickbox-plus/

Content Views 1.6.1
https://www.ads-software.com/plugins/content-views-query-and-display-post-page/

Delightful Downloads 1.5.2
https://delightfulwp.com/delightful-downloads/

DP Pro Event Calendar 2.4.5

Fast Secure Contact Form 4.0.37
https://www.FastSecureContactForm.com/

ImageInject 1.12
https://wpscoop.com/wp-inject/

InfiniteWP – Client 1.3.13
https://infinitewp.com/

MailMunch – Increase your Email Subscribers by over 500% 1.4.4
https://www.mailmunch.co

Portfolio Slideshow 1.5.1
https://madebyraygun.com/wordpress/plugins/portfolio-slideshow

RSS Just Better 1.3
https://www.stefaniamarchisio.com/rss-just-better-plugin-for-wordpress/

Share Buttons by AddToAny 1.5.8
https://www.addtoany.com/

Shortcodes Ultimate 4.9.7
https://gndev.info/shortcodes-ultimate/

UpdraftPlus – Backup/Restore 1.10.3
https://updraftplus.com

WPFront User Role Editor 2.10
https://wpfront.com/user-role-editor-pro/

WP Hide Dashboard 2.2.1
https://wphidedash.org/

And BTW, thank you for your support. And your plugin.

No idea. But I would turn it off in the theme, then try turning on Wordfence and making sure Falcon is disabled (choose no performance enhancement) then save.

tim

Just reporting back. I did all the steps you suggested. I disable gzip compression in my theme and uninstalled/reinstalled Wordfence without Falcon. So far the site is still up and OK.

My one remaining question: Since I didn’t have any caching installed anymore, I installed WP Super Cache just so I’d have some. My preference is to have as few plugins as i can get away with. And it bothers me to have a plugin (WF) that can do caching but not be using that and then having to have an additional plugin. How great a risk is it to enable Falcon if I deactivate Super Cache and therefor don’t have redundant caching going on?
Do you think that it was Falcon that borked my site? Or was it that I had 2 different gzips going on? I’m not even positive I had Falcon enabled as I don’t remember it and I uninstalled before looking closely at my settings.

I believe it was the two gzip functions that caused the problem. You can turn off the other caching plugin and turn on ours to try it out. Make sure and disable the caching for theirs, and clear the cache, disable their plugin, then enable falcon. You might even check your htaccess file before enabling Falcon to be sure that their code is out of it.

tim