Wordfence’s wfhoover table growing too big

Hi @jbd7, thank-you for getting in touch with us!

This issue is infrequent, but we do see issues mentioned often enough to suggest certain MySQL installations could be involved.

When you have a “large” wfHoover table, do you mean a high number of rows, or that it has 0 rows, but the size of the table is still large?

If you’re able to run a scan with Wordfence > Tools > Diagnostics > Debugging Options > Enable debugging mode enabled, and send the full scan log to wftest @ wordfence . com with your forum username in the subject line to help us find it, we can see how much it’s using wfhoover.

An exported txt file from your Wordfence > Tools > Diagnostics > EXPORT option after a scan has finished, but before manually clearing the table would also be great attached to the same email as above. Once you’ve obtained these, you can turn off our debug mode after the scan has finished.

If you’re also willing to send us an export of the table after a scan has finished, we may be able to see what’s happening. Even if the table is empty, the export will show how the table was created, or if it was modified in some way.

Many thanks,
Peter.

Thanks Peter.

I’ll share the scan log when I see the wfHoover table back, as it has not re-appeared yet. When it gets too big and my hosts turns MySQL into a read-only DB, I drop it. It seems I should be using TRUNCATE instead of DROP, I’ll do that next time.

I have been launching manual scans since the last time I dropped wfHoover, but none (Limited scan or Complete scan) have re-created the wfHoover table. They do all complete this way:

Nov 04 19:50:20:1699123820.378941:2:error] Scan terminated with error: Unable to query database
[Nov 04 19:50:19:1699123819.883299:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=845899redacted040c71a7&s=eyJ3cCI6IjYuMi4zIiwid2Yi845899redactediOC4xLjIzIiwicHQiOiJmcG0tZm845899redactedXC8xLjEuMW4iLCJzdiI6IkFwYWNoZSIsIm845899redactedhbmciOiIifQ&action=record_scan_metrics
[Nov 04 19:50:19:1699123819.881475:2:info] Done file contents scan
[Nov 04 19:50:19:1699123819.878411:4:info] Using MySQLi directly.
[Nov 04 19:50:19:1699123819.878035:4:info] Gathering host keys.
[Nov 04 19:50:19:1699123819.877590:2:info] Asking Wordfence to check URLs against malware list.
[Nov 04 19:50:19:1699123819.877143:2:info] Scanned contents of 3851 additional files at 3.30 per second
[Nov 04 19:50:19:1699123819.876528:4:info] No files remaining for malware scan.

This, while the DB is available as read-write and all checks on WF’s diagnostics page are green.

Therefore, I’ll let a random scan happen again in a few days, and check again once I get blocked by the host. I don’t recall how many lines did wfHoover have but will take note next time.

Hi again,

Since my last post, Wordfrence triggered 3 times a “Database quota exceeded” alert.

The first 2 times, it must have cleaned up wfHoover quickly enough, because that table was empty and my database was not set as read-only by my host.

The 3rd time, today, my database is still set as read-only because of wfHoover. Because of this, I cannot access WordPress admin, therefore cannot generate the logs you were asking for.

I can however use phpMyAdmin, which shows that wfHoover has 243871 total records for 53 MB.

The GZIP export of the table shows 1.8 million lines of values after “INSERT INTO”. The huge majority of them are links and images on URLs starting withwp-content/cache/page_enhanced/mywebsite.com/ (which I assume are due to my W3TC plugin).

I chose a few random image filenames, and noticed one image file appears 120 times in the wfHoover export. I use the Transposh plugin for translations into 5 languages, so each image file appears 20 times per language, with 20 different hostKey values.

Is that expected behavior?

I now have to truncate the table to be able to access my website again.

Going forward, I’ll try the exclusion proposal you made on https://www.ads-software.com/support/topic/the-scan-time-limit-of-8-hours-has-been-exceeded/

• This reply was modified 1 year ago by jbd7. Reason: Adding mitigation steps

A few hours later, my DB is blocked again, wfHoover‘s fault again, now it’s ~729,744 rows, 150.2 MiB according to phpMyAdmin, 267 MB as an uncompressed export.

The same rows with owner matching 'wp-content/cache/page_enhanced/mywebsite.com/.../_index_slash_ssl.html are taking most of the space.

So I added more expressions in the Wordfence scan file exclusion list to match combinations of _index_slash (with or without _ssl). html or xml.

I also had to truncate wffilemods and wfstatus that were roughly 15 MB each and 60k rows.

I finally managed to run a full scan, which populated wfHoover and deleted it afterwards. I don’t expect it to work okay every time though.

I don’t see any Wordfence performance settings that can help limit the size of the data it can use, is there anything related?

Even after a successful scan, now, Wordfence takes 40MB of space, mainly with wffilemods, wfstatus and wfknownfilelist