charlottezweb

@wfpeter – To your question about hosting, these are my servers and they are AlmaLinux 8.1 (cPanel) boxes with Imunify360. No litespeed or other addons to cPanel other than ModSec/CSF. I didn’t see any log indication that ModSec was involved.

I have multiple servers and so far I’ve only noticed it on one server but I haven’t tested this extensively. I have hardened php and 7.4 is the server version (with some older accounts defaulting to it). I confirmed a few unimpacted installs today while running normal WP plugin updates and at least one was on 7.3 (it was not impacted) and the ones above 8 were not. So I can’t confidently say it’s definitely 7.4 to blame but the few I was trying to troubleshoot yesterday were and switching to 8.1 instantly corrected it.

I have WordFence on all sites I personally manage (and a lot of my customers do as well) and the impact luckily hasn’t been as bad yet as I thought it might be. That said, not everyone messes with their sites daily so there could be more reports forthcoming.

Another interesting thing in my cases – The impacted sites weren’t loading “publicly” but the WP login page and admin area was. Go figure…

Thanks for investigating!

Cheers,
Jason

• This reply was modified 1 day ago by charlottezweb.

Was this resolved? I’m getting it after moving from PHP 7.4 to 8.1.

Update: Downgrading to 8.0 fixed it.

Thanks

• This reply was modified 1 day, 23 hours ago by charlottezweb.

Glad I’m not going crazy – I’ve had several sites so far today also stop working seemingly out of nowhere. These are sites I ran updates as recently as a couple days ago. Deactivating WordFence on one resolved the issue. I’m still digging into the others.

I’ve been running WordFence for as long as I can remember (free and paid licenses) on numerous sites and this is the first issue like this I’ve encountered.

PHP 7.4 is at play on at least one of these sites. I’ll upgrade it to an 8.x version tonight to see if re-activating WordFence continues to run.

Update: Switching the first account in question from 7.4 to 8.1 instantly solved the problem. Now on to my others…

• This reply was modified 1 day, 23 hours ago by charlottezweb.

Thank you for the clarification.

Regards,
Jason

A quick update that I just checked and the dashboard widget is now properly showing/blocking IPs.

Thanks for your help!

Regards,
Jason

Under Live Traffic, there are recent attempts from countries around the world to login as admin. Is each row representative of a single attempt or could it be multiple? If it’s only one attempt per row, then perhaps nobody is truly triggering a block.

Regards,
Jason

You removed them and then disabled wordfence and enabled again? Usually, that will recreate the cron.

Correct. I deleted the Wordfence crons in WP-Crontrol. Then I deactivated/activated Wordfence and that added them back.

You can deactivate WP Crontrol once you have finished working with the crons.

Ok, I’ll do this now.

Is it possible that No IPs are currently being blocked? Are you seeing anything in Live Traffic?

Yes, I’m seeing visitors from all around the globe on the Live Traffic page. No IP blocks listed at all other than the one I manually added myself.

If I change the filter on the Live Traffic page to blocked, the last block was on Sept 7th. If I change the filter to “blocked by firewall” there are zero.

Regards,
Jason

Hi @wfadam,

I haven’t seen any change since yesterday.

Should I deactivate the WP_Crontrol plugin to let WP run crons on its own? If so, I didn’t do that yesterday.

One thing that’s odd is that the plugin page shows that the hourly crons are not actually running hourly. Is this representative of a problem?

For example, here’s a screenshot of the WP-Crontrol events page:

https://i.imgur.com/5poYrqf.gif

Regards,
Jason

Thank you.

The “overdue” crons were daily ones and they were showing as having run a few hours ago based on WP-Crontrol.

Either way, I followed your instructions and the crons show as having run again. Data hasn’t updated on the dashboard but I’ll give it another 24 hours to see what happens.

Regards,
Jason

I’ve sent the report – Thank you!

I also ran a mysql check on that db and all tables were “ok.”

Regards,
Jason

Also, for some perspective on why I think something is odd…

On the Firewall page under “Top IPs Blocked” there are zero under the last 24 hours and 7 days yet there are more than 680 under the last 30 days. That seems like a big drop to go from that to zero.

Regards,
Jason

If I go to Firewall > Blocking and scroll down to the “Current blocks for [site]” there’s only the manual one I added.

“Show Wordfence Automatic Blocks” is also enabled.

Regards,
Jason

Thanks Scott,

I apprecate the update.

Unfortunately I’m not having any luck. I upgraded to 1.6.7 and tried all four storage options:

DOM wpcf7mailsent event listener and Sessions
DOM wpcf7mailsent event listener and Cookies
2 (Form sent class listener) and cookies
2 (Form sent class listener) and sessions

The forms are going through but no redirect.

I’ve checked all the options in your plugin and they look correct.

On the contact form7 contact pages, on the PayPal/Stripe tab, Paypal is enabled.

I even tried switch to a default WP (stock) theme to see if that made a difference and it didn’t.

I’m stumped.

Regards,
Jason

Hi Scott,

I posted that last week but the post is gone. Strange.

Here’s one of the example forms:

https://www.planetairedale.com/forum-member/

Feel free to submit tests.

I uninstalled Contact Form (not your plugin) yesterday and installed the previous version per one of the solutions someone else posted above. It wiped out the forms which I was hoping it was going to retain. So if I need to create them from scratch I’ll have to schedule time to do that. I reverted the changes I made yesterday.

We’re only using Paypal (not Stripe). It is the free version but the pro version may be an option if there’s a driver in going that route. I didn’t set this up for them originally but am trying to help them navigate it now that it’s not working.

Thank you!

Regards,
Jason

Still no luck.

Reinstalling contact form 7 deletes my forms.

Any ideas you have would be appreciated.

-Jason