• Hi,

    So basically after some work I’ve noticed that WP autoupdates were started with a severe delay (the expectation given by WP for the next run was 2 days when usually the cron should run twice per day) so I started to investigate a bit further. I’ve installed WP Crontrol and what I’ve noticed is that there was no way for me to execute a cron, both if it was already scheduled or if I would ask to the plugin to run now.

    After a deep investigation, I’ve discovered the issue was connected with All In One WP Security because once it was disabled everything was working fine. I’ve tried many indications here in the forum but nothing helps: Now no security feature or firewall rule is active and the problem is still there. I have no IP blocked, and also trying to whitelisting the server IP doesn’t help.

    The unique way to fix it as of now is disabling the plugin. Can you help me with this please?

    Note: I already have a staging site to recreate the issue: if you need credentials there is no problem to me to give you.

    Thanks in advance for your help,
    Matteo

    The page I need help with: [log in to see the link]

Viewing 15 replies - 1 through 15 (of 16 total)
  • Plugin Support hjogiupdraftplus

    (@hjogiupdraftplus)

    Hi @matteospi

    Sorry. As per the www.ads-software.com support forum guidelines It is not allowed to share credentials.

    Please make sure you have correct IP detection method selected WP security > Settings > Advanced setttings.

    And try to disable one by one below setting and cross check if it solves the issue.

    1) REST API – WP Security > Firewall > WP REST API Can you please cross check the Disallow unauthorized REST requests:
    2) Deny bad query string – WP Security > Firewall > PHP rules tab. Deny bad query strings: uncheck the checkbox and save
    3) Advanced char filter – WP Security > Firewall > PHP rules tab. Enable advanced character string filter :uncheck the checkbox and save
    4) 5g firewall rules – WP Security > Firewall > 6G Blacklist firewall rules tab. Enable legacy 5G firewall protection uncheck the checkbox and save
    5) 6g firewall rules – WP Security > Firewall > 6G Blacklist firewall rules tab. Enable 6G firewall rules – uncheck the checkbox and save
    6) WP Security > Firewall > Internet bots ban – Blank HTTP headers Ban POST requests that have a blank user-agent and referer

    Regards

    Thread Starter Matteo Spirandelli

    (@matteospi)

    Hi @hjogiupdraftplus,

    Thanks for your answer. As said in the previous message, all security settings and rules are disabled, but let’s go more deeply and check what you’ve suggested.

    I’ve checked the IP address detection settings and the only option I can use is “REMOTE_ADDR” and it shows me my correct IP Address.

    Back to the settings:

    1. Already disabled
    2. Already disabled
    3. Already disabled
    4. Already disabled
    5. Already disabled
    6. Already disabled

    As stated before, as of now no firewall rule or settings are enabled.

    Said this, it’s true that for some settings, also if the tick is disabled, the score is calculated as it is enabled. Image as an example: https://snipboard.io/FDOvNi.jpg

    I’ve disabled it using buttons in WP Security -> Settings in the first screen that appears.

    Please let me know how to proceed.

    Thanks in advance,
    Matteo

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi,

      WP Security > Firewall > Internet bots – Disable fake Google bots.

      If you disable the fake Google bot settings still It is an issue?

      It seems less chance that your cronjob can be blocked due to being considered fake Google bot.

      Can you please cross-check any log there if DEBUG_LOG is enabled?

      If all settings are disabled it should not be any rule which should be blocking running cron.

      WP security > Settings > Import / Export settings – exported settings you can share with me

      https://pastebin.com/ if possible you may use the burn after-read option.

      Also please let me know if any other security plugins you have installed.

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      Hi,

      As you can see in the screenshot itself, the option is disabled but score seems saying it’s enabled. Not sure if there is a bug with this.

      DEBUG_LOG is active (and also debug from the plugin is enabled) but no log is made. Export settings are here: https://onetimesecret.com/secret/tm52ozatlogxi6k4f3tgcoplr8wv4y6

      I use Cloudflare, Firewall BBQ and some captcha plugins. Abnyway I’ve done many test and issue is just dependent from if the AIOWS is enabled or not.

      Thanks.

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi,

      Score seems to say it’s enabled might be a bug, Disable fake google bot is now moved to the firewall rule. I will create internal ticket to check that and solve the issue.

      Do this site run under a subfolder where in parent folder AIOS pluign was enabled.

      All settings here on site are disabled, can you please cross-check the wp-config.php, htaccess, .user.ini file in root of the wordpress installed directory include the aios-bootstrap.php is correct path.

      Also aios-bootstrap.php file content has the correct path to your WordPress installed folder.

      Which cron event you try to run ?

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      Hi,

      So basically to do these test I’m using a staging site.

      itechblog.it and the staging site are on a completely different folders. On the main site, AIOS is enabled with its rules, but on the testing site I have AIOS enabled with the configs you read.

      I have checked for the file you indicated if there was some reference to the aios-bootstrap.php file. I’ve found references in wp-config and in user.ini but nothing else.

      I cross-checked also the aios-bootstrap.php file and the WP directory is correct.

      Which cron event you try to run ?

      As explained in the first message in the topic, all wp cron have this same issue. No matter which one.

      I’m copying here again for your convenience the message I sent first. Please read it carefully, it will help you and me to save time and solve this issue faster:

      Hi,

      So basically after some work I’ve noticed that WP autoupdates were started with a severe delay (the expectation given by WP for the next run was 2 days when usually the cron should run twice per day) so I started to investigate a bit further. I’ve installed WP Crontrol and what I’ve noticed is that there was no way for me to execute a cron, both if it was already scheduled or if I would ask to the plugin to run now.

      After a deep investigation, I’ve discovered the issue was connected with All In One WP Security because once it was disabled everything was working fine. I’ve tried many indications here in the forum but nothing helps: Now no security feature or firewall rule is active and the problem is still there. I have no IP blocked, and also trying to whitelisting the server IP doesn’t help.

      The unique way to fix it as of now is disabling the plugin. Can you help me with this please?

      Note: I already have a staging site to recreate the issue: if you need credentials there is no problem to me to give you.

      Thanks in advance for your help,
      Matteo

      Many answers are already there, because I read many topics about this issue before ad I know a few things about what you’re trying to find.

      Thanks in advance for your help.
      Matteo

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi,

      Ok, I will create an internal ticket to try replicate this issue and get back to you asap.

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      Any update on this? It’s quite critical.

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi

      We can not replicate the issue.

      For twice daily event, I have added the log in that event function When run that event it logs and the function works.

      I have tried check also auto updates works for the site having AIOS installed. Rolled back the plugin and make sure auto update is enabled, It got updated.

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      At the end, I’ve fixed the issue reinstalling AIOWPS. The issue is there, the fact that recreating it is hard is understandable but you shouldn’t stop investigating it just because you can’t recreate the situation.

      Thread Starter Matteo Spirandelli

      (@matteospi)

      it seems like the problem is still there and reappeared after some time. Can you investigate further please? It’s a very urgent matter.

      Thanks.

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi

      Ok. Generally, WP Cornjobs do not depend on the server but which server do you use? Nginx or Apache?

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      Hi,

      I use Apache.

      Thanks.

      Plugin Support hjogiupdraftplus

      (@hjogiupdraftplus)

      Hi @matteospi

      Thanks for the info. We have cross-checked previously on apache.

      Regards

      Thread Starter Matteo Spirandelli

      (@matteospi)

      so what now?

    Viewing 15 replies - 1 through 15 (of 16 total)
    • You must be logged in to reply to this topic.