Wordfence Application Firewall installation

Hi,

Wordfence is not officially supported on Windows Server and IIS, but we have had some reports of it working.

In this case, you may need to have a separate php.ini file for each site — you’re correct that only the last auto_prepend_file is effective. I’m not sure how to configure this on IIS. This document is a bit old, but it might give you a place to start:
https://www.iis.net/learn/application-frameworks/install-and-configure-php-on-iis/enable-per-site-php-configuration-on-iis-60-and-iis-7-and-above

-Matt R

Thanks I got it to work with the path statement.
For any one else who has multiple sites on IIS.
Add the following lines to the END of the php.ini file

[PATH=C:/inetpub/wwwroot/wp_xxxx/]
auto_prepend_file = ‘C:\inetpub\wwwroot\wp_xxxx/wordfence-waf.php’

as described in:
https://www.iis.net/learn/application-frameworks/install-and-configure-php-on-iis/enable-per-site-php-configuration-on-iis-60-and-iis-7-and-above

An option to dismiss the notification would also be a happy welcome for people on IIS atm.

Thanks for confirming that, @njsent!

@hjsurk: A maintenance release will be coming out soon to allow the notice to be dismissed as well, if you can’t complete the setup on your server or don’t want to yet. Thanks!

-Matt R

@njsent

I read through the link you provided as referenced, along with your comments, and I’m still about as confused as a newborn in a Gentleman’s Club.

I’m running single installation of PHP 5.4, and many WP installations that follow the path convention of C:\sites\site_directory.

Are you suggesting for each WP site I need to add the PATH lines to the php.ini?

For example, I have two sites – websiteA and websiteB. Do I add the following to the end of my php.ini file?

[PATH=C:\sites\websiteA\]
auto_prepend_file = 'C:\sites\websiteA\wordfence-waf.php'

[PATH=C:\sites\websiteB\]
auto_prepend_file = 'C:\sites\websiteB\wordfence-waf.php'

I would test this myself, unfortunately, I don’t have a DEV server…everything is in production, and I’d rather not muck up 20-ish active/running web sites. ??

Correct, I had to add the path statement at the end of my php.ini for each website on the server.
This is the only way I could get the correct wordfence-waf.php file be processed for each website.
I am running server 2012r2 and IIS.

This process is described in
https://www.iis.net/learn/application-frameworks/install-and-configure-php-on-iis/enable-per-site-php-configuration-on-iis-60-and-iis-7-and-above

@njsent – ok, very interesting development on my server…I put in a PATH statement as described above referencing one of my many sites. I just went to another site (actually, a few other sites) and logged it to the dashboard. Although they’re not described in the PATH, they now show the WF Firewall as configured and running. Some sites, if using a premium key, show they’re running the premium version of the firewall.

My guess is that I won’t be able to do any custom configuration to the sites that are not referenced in the php.ini, or, any changes made on one site will affect the same change on all the other site(s) regardless of whether or not they are listed for the auto_prepend_file in the php.ini file.

Very strange.

Use the phpinfo() statement in a page, to display the php settings for the site.
You need to make sure that each site is using the correct wordfence-waf.php file. Mine were all using the same file until I put the path statements into the php.ini

@njsent It just struck me as very odd that by referencing one “instance” of the WF firewall, that all of them started “working”.

I will do the phpinfo() trick and see what’s happening.

Thanks for the help on this…I really appreciate you taking the time to respond.

@njsent – I just had the chance to double-back to this issue, and I’m still seeing problems. I dropped a phpinfo() page into the site I’m working with, and even though I see the correct path to the php.ini file, I’m not seeing anything in phpinfo where it suggests that it’s loading the wordfence-waf file.

In both the Enviornment:Path and _Server[“PATH”] blocks I see a number of files listed, but nothing pointing to wordfence-waf.

Am I looking in the correct place to see the info I expect?

Thanks again for the help…sorry to be such a repeat pain.

Take care,
Ric

I am using PHP 5.6.20
I see in the Core section about 9 lines down.
auto_prepend_file and it points to the individual sites (i.e.
c:\intepub\wwwroot\site\wordfence-waf.php )

Got it…I see the auto_prepend_file now, and mine says ‘no value’ for both Local Value and Master Value.

I’m using PHP 5.4.9…I wonder if it’s just a matter of upgrading PHP to produce the same results. I really hope not…upgrading PHP is a PITA on IIS.

Me i dont have access to the php.ini and i cannot add variables.
How do we configure manually the .htaccess ?