Wordfence scans not completing

  • Resolved hair2

    (@hair2)


    7 years, 8 months ago

    My Wordfence scans don’t seem to be completing. They do some of the steps then get stuck indefinitely. Here’s the log from my last attempt. At the time of writing, 45 minutes has passed since the last line of the log was written.

    [Mar 26 12:12:31:1490530351.643085:4:info] getMaxExecutionTime() returning config value: 20
    [Mar 26 12:12:31:1490530351.642758:4:info] Got value from wf config maxExecutionTime: 20
    [Mar 26 12:12:31:1490530351.641743:4:info] Calling startScan(true)
    [Mar 26 12:12:31:1490530351.413809:4:info] Entered fork()
    [Mar 26 12:12:31:1490530351.413489:4:info] Forking during indexing: /home/neiloseman/public_html/wp-content/uploads/2016/07/IMG_0572-150×150.jpg
    [Mar 26 12:12:31:1490530351.413119:2:info] 9296 files indexed
    [Mar 26 12:12:28:1490530348.673035:2:info] 9000 files indexed
    [Mar 26 12:12:28:1490530348.339098:2:info] 8500 files indexed
    [Mar 26 12:12:26:1490530346.409259:4:info] Found .suspected file: wp-content/uploads/2015/09/.settings.php.suspected
    [Mar 26 12:12:26:1490530346.389739:2:info] 8000 files indexed
    [Mar 26 12:12:26:1490530346.172050:2:info] 7500 files indexed
    [Mar 26 12:12:25:1490530345.956820:2:info] 7000 files indexed
    [Mar 26 12:12:25:1490530345.255154:2:info] 6500 files indexed
    [Mar 26 12:12:25:1490530345.015454:2:info] 6000 files indexed
    [Mar 26 12:12:25:1490530345.008073:4:info] Found .suspected file: wp-content/uploads/2014/02/9781408100035.php.suspected
    [Mar 26 12:12:24:1490530344.565871:2:info] 5500 files indexed
    [Mar 26 12:12:24:1490530344.149250:2:info] 5000 files indexed
    [Mar 26 12:12:23:1490530343.689057:2:info] 4500 files indexed
    [Mar 26 12:12:23:1490530343.269281:2:info] 4000 files indexed
    [Mar 26 12:12:22:1490530342.820693:2:info] 3500 files indexed
    [Mar 26 12:12:21:1490530341.665543:2:info] 3000 files indexed
    [Mar 26 12:12:20:1490530340.752532:2:info] 2500 files indexed
    [Mar 26 12:12:19:1490530339.782492:2:info] 2000 files indexed
    [Mar 26 12:12:18:1490530338.370434:2:info] 1500 files indexed
    [Mar 26 12:12:15:1490530335.954063:2:info] 1000 files indexed
    [Mar 26 12:12:14:1490530334.795458:2:info] 500 files indexed

    My site – https://neiloseman.com – is currently hacked with a redirect which sends some visitors to a fake Abobe Flash Player update or other spam page. I’m desperate to complete a scan so I can find and eliminate the malicious code causing this (and yes, I’ve manually deleted the suspected files listed in the above log). But perhaps Wordfence itself is being affected by the hack and that’s why the scans aren’t completing?

    I also wondered if the problem might lie with my server (which is Linux) somehow. Lately when working in the back end of the site – e.g. when I click Save Draft on the Edit Post page – the page often fails to load, with the following error message: “Internal server error. The sever encountered an internal error or misconfiguration and was unable to complete your request. Please contact the sever administrator at xxxx to inform them of the time this error occurred, and the actions you performed just before this error. More information about this error may be available in the server error log. Additionally, a 500 Internal Sever Error was encountered while trying to use an ErrorDocument to handle the request.”

    Could these all be symptoms of a single problem?

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter hair2

    (@hair2)

    BTW, I am using Wordfence 6.3.5.

    Thread Starter hair2

    (@hair2)

    I just tried a new scan and this time it ending after forking.

    [Mar 26 14:08:03] Ajax request received to start scan.
    [Mar 26 14:08:03] Entering start scan routine
    [Mar 26 14:08:03] Got value from wf config maxExecutionTime: 20
    [Mar 26 14:08:03] getMaxExecutionTime() returning config value: 20
    [Mar 26 14:08:04] Test result of scan start URL fetch: array ( ‘headers’ => Requests_Utility_CaseInsensitiveDictionary::__set_state(array( ‘data’ => array ( ‘date’ => ‘Sun, 26 Mar 2017 14:08:03 GMT’, ‘server’ => ‘Apache/2.4.25’, ‘x-powered-by’ => ‘PHP/5.4.45’, ‘x-robots-tag’ => ‘noindex’, ‘x-content-type-options’ => ‘nosniff’, ‘expires’ => ‘Wed, 11 Jan 1984 05:00:00 GMT’, ‘cache-control’ => ‘no-cache, must-revalidate, max-age=0’, ‘x-frame-options’ => ‘SAMEORIGIN’, ‘set-cookie’ => ‘wfvt_2395973900=58d7cb446ff6f; expires=Sun, 26-Mar-2017 14:38:04 GMT; path=/; httponly’, ‘vary’ => ‘Accept-Encoding,User-Agent’, ‘content-encoding’ => ‘gzip’, ‘content-length’ => ’32’, ‘content-type’ => ‘text/html; charset=UTF-8’, ), )), ‘body’ => ‘WFSCANTESTOK’, ‘response’ => array ( ‘code’ => 200, ‘message’ => ‘OK’, ), ‘cookies’ => array ( 0 => WP_Http_Cookie::__set_state(array( ‘name’ => ‘
    [Mar 26 14:08:04] Starting cron with normal ajax at URL https://neiloseman.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&cronKey=xxxxxxxxxxxxxxxx
    [Mar 26 14:08:06] Scan process ended after forking.

    • This reply was modified 7 years, 8 months ago by hair2.

    If your scans do not complete, it may be due to a plugin conflict or Wordfence IP is getting blocked by your host.

    Read this – https://docs.wordfence.com/en/My_scans_don%27t_finish._What_would_cause_that%3F

    Disable all unnecessary plugins, then uncheck most scan options, then try a scan during times of lower server load, and of course check “Low Resource Scanning.” Gradually add things back in and see how it goes. MTN

    Hi @hair2
    You should try adjusting both, the max execution time and the memory limit according to the documentation pages I linked to. Also, you can “Enable debugging mode” from (Wordfence > Tools => Diagnostics => Debugging Options) and let me know if any new error message appeared after running a new scan.

    In general, it’s recommended to upgrade PHP installed on your server to version 5.6 or newer, WordPress recommends version 7 or newer.

    Thanks.

    Thread Starter hair2

    (@hair2)

    Thanks everyone for your help. I was able to clean the hack by manually locating some malicious files, then using another security plug-in to locate the rest. This has put an end to the internal server errors, though I still couldn’t get the Wordfence scans to complete, so I’ve decided to stick with the alternative plug-in.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Wordfence scans not completing’ is closed to new replies.