WordFence giving scan results from old server

  • Resolved lordsnake

    (@lordsnake)


    6 years, 11 months ago

    I have just noticed that the WordFence scan results are not from the current site/server, it is showing results from an old copy of the site which was hosted elsewhere.
    There is ZERO chance of any confusion here because it was on a windows server previously, it is now on Linux, and the paths are completely different.

    e.g. here is one alert

    Old WordPress core file not removed during update: wp-admin/C/home/mydomain.com/wwwroot/wp-content/plugins/duplicator-clone/tmp/jobs/job_2018-01-11_22-58-17_local_backup_files

    As you can see the path is a windows path, so doesn’t exist, also the plugin and folder doesn’t exist as I have deleted it weeks ago.

    The site on the old server still existed, so I went and deleted it, and now the WordFence scan won’t run. So I assume that every time it runs it was running on the old server not the current one, although I am not sure how.

Viewing 5 replies - 1 through 5 (of 5 total)

  • Hi @lordsnake,

    Could it be that you’re actually accessing a “cached” version of your old site? Or maybe that the DNS entry still points to that Windows host?

    If you open the the Wordfence System Info page:

    • Go to the Wordfence Tools page
    • Click the Diagnostics tab
    • In the Other Tests section (near the bottom of the page), click the link that reads “Click to view your system’s configuration in a new window“

    and check the first line on that page (System); what does it say?

    Thread Starter lordsnake

    (@lordsnake)

    no, it is not cached version of the old site.
    The DNS is correct, if it was still pointing at the old server, then nothing would be displayed, as there no such site running at the old server anymore.

    The system configuration shows the currect paths from the current server.

    I finally fixed the scan problem, it required an entry for LiteSpeed to be added in the .htaccess.
    But it still kept reporting the same issues from non existant files/paths from the old server, it couldn;t have even tried to delete, since they were windows paths, so should have thrown an error.

    I could even select and choose DELETE, and it said it deleted them, which of course it didn’t because they don’t exist, but still did not remove the entry from the scan results.
    I even removed the plugin and re-added.

    I had to go through each one and mark as fixed to get rid of it.

    Hi @lordsnake,

    Thanks for the update. I’ve discussed this topic with my colleagues and we’re still unsure of what’s happening.

    Could you please check in “wp-admin/” if there’s a directory named “C”? If so, is it a symlink?

    Also, now that you’ve marked the aforementioned issues as fixed, are they still reported when you run a new scan?

    Thread Starter lordsnake

    (@lordsnake)

    well spotted, the folder structure from the old server was somehow re-created in the wp-admin folder.
    I have no idea how that happened.
    I have now deleted the folder.

    Thanks for the update, @lordsnake.

    I’m glad we cleared up this mystery!

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘WordFence giving scan results from old server’ is closed to new replies.