Wordfence Scan Failed

  • Resolved sally

    (@sallyruchman)


    4 years, 5 months ago

    Hello,
    i have wordfence installed on siteground hosting, with actual wp version etc, but i don’t get the scans working.

    I have already done the troubleshooting steps here:

    https://www.wordfence.com/help/scan/troubleshooting/#if-your-scans-arent-starting

    I use in my htaccess wp-login protection, excluded there the wordfence servers as well:

    # Protect wp-login.php
    <FilesMatch “^(wp-login\.php|wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)”>
    <IfModule mod_authz_core.c>
    Require all denied
    Require ip 44.239.130.172
    Require ip 44.238.191.15
    Require ip 35.155.126.231
    Require ip 54.68.32.247
    Require ip 44.235.211.232
    Require ip 54.71.203.174
    </IfModule>

    <IfModule !mod_authz_core.c>
    <IfModule mod_access_compat.c>
    Order Allow,Deny
    Deny from all
    Allow from 44.239.130.172
    Allow from 44.238.191.15
    Allow from 35.155.126.231
    Allow from 54.68.32.247
    Allow from 44.235.211.232
    Allow from 54.71.203.174
    </IfModule>
    </IfModule>
    </FilesMatch>
    Expand
    Even if i deactivate the additional htaccess protection code and restart the scan, the scan fail.

    Any Idea how to fix?
    Thx
    best regards
    Sally

Viewing 8 replies - 1 through 8 (of 8 total)
  • Thread Starter sally

    (@sallyruchman)

    4 years, 5 months ago

    I tried already to set Maximum execution time for each scan stage to 20 and 40 as i saw in a other thread, but still scan failed.

    How to fix this?
    Thx
    br
    Sally

    Plugin Support wfpeter

    (@wfpeter)

    4 years, 5 months ago

    Hi @sallyruchman,

    My main focus to start would be to see what is stopping the scans from running under normal circumstances with no external restrictions. Could you please disable the .htaccess code you’ve added to restrict IPs and send us a scan log and site diagnostic report so we can see what’s going on to prevent scans from working.

    You can send a scan log by:

    • Going to the Tools > Diagnostics page
    • In the “Debugging Options” section check the circle “Enable debugging mode”
    • Click to “Save Changes”.
    • Start a new scan
    • Copy the last 20 lines or so from the Log (click the “Show Log” link) once the scan finishes and paste them in the post.

    Please also send a diagnostic report to wftest @ wordfence . com during this time. You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    Note: For the fastest response time, please make sure and add any information or questions directly to this topic and not the email address above unless asked.

    Thanks,

    Peter.

    Thread Starter sally

    (@sallyruchman)

    4 years, 5 months ago

    Hello Peter,

    thanks for the information. htaccess disabled, debugging enabled scan done, still the issue. reports are send.

    Please see here Log: 

    [Apr 27 07:29:23:1619522963.782164:4:info] Scan process ended after forking.
[Apr 27 07:29:23:1619522963.377117:4:info] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/www.domain.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=highsensitivity&cronKey=xxxxx
[Apr 27 07:29:23:1619522963.376533:4:info] getMaxExecutionTime() returning config value: 100
[Apr 27 07:29:23:1619522963.376337:4:info] Got value from wf config maxExecutionTime: 100
[Apr 27 07:29:23:1619522963.376010:4:info] Entering start scan routine
[Apr 27 07:29:23:1619522963.374964:4:info] Ajax request received to start scan.
[Apr 27 07:29:11:1619522951.517896:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k= xxxxx&betaFeed=0&action=timestamp
[Apr 27 07:27:12:1619522832.996248:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Apr 27 07:27:12:1619522832.995703:1:info] Scan stop request received.
[Apr 26 05:47:33:1619430453.659760:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Apr 26 05:47:33:1619430453.659171:1:info] Scan stop request received.
[Apr 26 05:27:58:1619429278.077018:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Apr 26 05:27:58:1619429278.075529:1:info] Scan stop request received.
[Apr 26 05:16:49:1619428609.641353:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Apr 26 05:16:49:1619428609.640689:1:info] Scan stop request received.

    Thx
    best regards
    Sally

    Plugin Support wfpeter

    (@wfpeter)

    4 years, 5 months ago

    Hi @sallyruchman,

    I’ve seen SUM_KILLED a couple of times and there’s also a key error of Scan process ended after forking. There are some things you can try.

    This error suggests that something is blocking access to the wp-admin directory which contains the admin-ajax.php file Wordfence needs access to.

    Please check the instructions under Scan process ended after forking in our documentation to ensure permissions or blocks are not preventing access to the wp-admin folder. Memcache or object-cache may also need to be restarted twice – they appear to be present on your configuration. Also ensure your own server IP has access to this folder.

    Your site appears to be protected by Cloudflare, so you may need to update your Cloudflare settings to allow your site to connect back to itself. You should be able to do this by going to your Cloudflare control panel.

    • Login to Cloudflare
    • Go to “Firewall”
    • Click the “Firewall Rules” tab
    • Click “Create a Firewall rule”
    • Name the rule under “Rule Name”
    • Set the “Field” under “When incoming requests match…” to “IP Address”
    • Enter your site’s IP address under “Value”
    • At the bottom, under “Then…Choose an action” change “Block” to “Allow”
    • Click “Deploy

    Once you have added your site to the Cloudflare Whitelist, head back over to your site and attempt another scan.

    Let me know how you get on!

    Peter.

    Thread Starter sally

    (@sallyruchman)

    4 years, 5 months ago

    Hello @wfpeter

    I disabled htaccess protection, allowed Site IP address in Cloudflare. Checked the Instructions what you send me. Enabled Debug Options again and started Scan, still the same issue. Send Report by eMail after scan a couple of minutes ago again.

    Please see here Log:

    [Apr 28 07:29:48:1619609388.852323:4:info] Scan process ended after forking.
[Apr 28 07:29:48:1619609388.518385:4:info] Starting cron via proxy at URL https://noc1.wordfence.com/scanp/domain.com/wp-admin/admin-ajax.php?action=wordfence_doScan&isFork=0&scanMode=custom&cronKey=xxxxxx
[Apr 28 07:29:48:1619609388.517667:4:info] getMaxExecutionTime() returning config value: 100
[Apr 28 07:29:48:1619609388.517424:4:info] Got value from wf config maxExecutionTime: 100
[Apr 28 07:29:48:1619609388.516910:4:info] Entering start scan routine
[Apr 28 07:29:48:1619609388.515874:4:info] Ajax request received to start scan.
[Apr 28 07:29:39:1619609379.650993:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=xxxxx &betaFeed=0&action=timestamp
[Apr 28 07:29:16:1619609356.409772:10:info] SUM_KILLED:A request was received to stop the previous scan.
[Apr 28 07:29:16:1619609356.409400:1:info] Scan stop request received.
[Apr 28 07:26:26:1619609186.841502:4:info] Calling Wordfence API v2.26:https://noc1.wordfence.com/v2.26/?k=xxxxx&betaFeed=0&action=timestamp

    What else can be done?

    Thread Starter sally

    (@sallyruchman)

    4 years, 5 months ago

    Any other options?

    Plugin Support wfpeter

    (@wfpeter)

    4 years, 5 months ago

    Hi @sallyruchman,

    I took a look at the second diagnostic that came through from your site and all of your connectivity to our servers and back to your site are reporting successfully so it’s strange that updating the Cloudflare firewall did not immediately fix the issue. Your server memory limits also look good although default max execution time looks a bit high.

    Please try the following:

    • Kill the existing scan if it is still running (The “Start New Scan” button turns in to a “Stop” button while the scan is running)
    • Go to your Scan > Scan Options and Scheduling page and locate the “Performance Options”
      Set “Maximum execution time for each scan stage” to 20 on the options page
    • Click to “Save Changes”
    • Start a new scan

    If that still reports the same scan error in the debug log, please also try enabling low resource mode:

    • Navigate to Wordfence > All Options
    • Scroll to the “Performance Options” section.
    • Check the box that says “Use low resource scanning (reduces server load by lengthening the scan duration)”.
    • Save the change.
    • Start a new scan

    Let me know how that goes.

    Peter.

    Plugin Support wfpeter

    (@wfpeter)

    4 years, 5 months ago

    Hi @sallyruchman,

    I just saw your input on this other topic but wanted to address the issue here in case you don’t have this mode enabled and your resolution is still separate.

    However, if you do have “Bot Fight Mode”, perhaps also called “Bot Report” enabled, it seems likely that this is the cause of scans failing. If you turn the feature off, are you able to scan? If you never had it enabled, let me know.

    Thanks again,

    Peter.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Wordfence Scan Failed’ is closed to new replies.