Wordfence Error: -200, Message: HTTP Error

On another idea, same theme and plugins, on another site, but with security mod on and all looks ok. no error …

Hi @kpk1l,

I experienced a similar issue when trying to upload images using Gravity Forms.

The solution for me was to switch Wordfence to learning mode (for one week).

Below please find a few more helpful references:

https://www.ads-software.com/support/topic/gravity-forms-file-upload-blocked-by-wordfence/
https://www.ads-software.com/support/topic/file-upload-error-22/
https://www.ads-software.com/support/topic/blocked-by-firewall-for-malicious-file-upload/

Last, if you perform topic search in this forum, you’ll probably find a few more helpful answers.

Cheers!

Hi @generosus
So if I change to learning mode after a week will work normal?
Thanks

Hi @kpk1l,

There’s only one way to find out. You may need to increase the learning mode to two weeks if there’s not much activity on your website.

Did you read what I shared?

Best wishes.

Hi @kpk1l,

The information you’ve been provided with can be very useful regarding turning Learning Mode on to catch all events related to these uploads. Let us know how you get on!

One thing I will add, is that have recently had to recommend turning the Wordfence > All Options > Advanced Firewall Options > Rules > Malicious File Upload (PHP) toggle off for some customers running PHP8 as the flexibility of what it considers valid PHP code makes for an increase in false-positives. So if you are running PHP8 this could be a factor.

There are actually two rules for Malicious File Upload, the second titled “Malicious File Upload (Patterns)”. This rule checks the actual contents of the uploaded file(s) for malicious code, so if you are able to continue running Wordfence successfully with this turned on, you are still very well protected.

Thanks,

Peter.

Hi @wfpeter Thanks for reply.
Yes. I have php8. I will come back when Learning mode ends.

So I will turn these 2 rules off and enable again after 1 week right?

Hi @kpk1l,

Please leave “Malicious File Upload (Patterns)” turned on, but with PHP8 it’s highly recommended to turn “Malicious File Upload (PHP)” off to reduce false-positives. Rolling back to PHP7 would also of course be an option.

Only leave Learning Mode running for around a week to catch requests that should be allowed but make sure to turn it back to Enabled and Protecting afterwards.

Thanks again,

Peter.

Hi @wfpeter,

Thank you for the information. Very helpful.

Useful: Learning mode did not help fix our same issue (-200 HTTP Error), so we followed your above recommendations. Issue resolved for now. We are using PHP 8.1.3.

Do you know when Wordfence plans to fix the bug you reported such that we can re-enable the firewall rule, Malicious File Upload (PHP), under PHP 8?

Again, thank you!

Hi @generosus @wfpeter
Thanks for the help.
I used Learning mode 1 week, with Malicious File Upload (PHP) on
And now it seems is working fine.
Thanks again

Great news @kpk1l, by all means start a new topic if you have any Wordfence questions in the future.

@generosus We are currently working on any features or code affected by PHP8 although I don’t have any firm dates. As WordPress is PHP8 compatible, with the exception of non-critical deprecation notices, most sites should function without issue. Also, I should mention that the patterns check that can remain on provides the higher level of security when checking an uploaded file.