Files created in wflogs before plugin activated

  • Resolved Jamie Burchell

    (@jamieburchell)


    6 months, 3 weeks ago

    Just installed a fresh WordPress install with Wordfence and noticed the wflogs directory has been populated with new files (written by the web user) before the plugin is activated:

    -rw-rw----+ 1 apache apache 40083 Sep  2 14:43 attack-data.php
    -rw-rw----+ 1 apache apache   618 Sep  2 14:43 config-livewaf.php
    -rw-rw----+ 1 apache apache   560 Sep  2 14:43 config.php
    -rw-rw----+ 1 apache apache   765 Sep  2 14:43 config-synced.php
    -rw-rw----+ 1 apache apache   661 Sep  2 14:43 config-transient.php
    -rw-rw----+ 1 apache apache    51 Sep  2 14:43 ips.php
    -rw-rw-r--+ 1 apache apache     0 Sep  2 14:43 rules.php

    The wordfence-waf.php is being appended to requests, but surely these files shouldn’t exist prior to activation?

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Support wfpeter

    (@wfpeter)

    6 months, 3 weeks ago

    Hi @jamieburchell,

    The even stranger occurrence is that wordfence-waf.php is being appended to requests. Even if you’d activated Wordfence after installation, it isn’t until you enable Extended Protection on the WAF that your server platform is even detected and auto_prepend_file (in most cases, from .htaccess) tells that file to run before content is served to the user’s browser. It’ll run in Basic Protection by default when that hasn’t been done yet.

    I would suspect that Wordfence is already running on a site elsewhere on the server and this new installation is in a child folder, so is being affected by another .htaccess? Could you clarify the platform/host and whether this new site is entirely standalone?

    Thanks,
    Peter.

    Thread Starter Jamie Burchell

    (@jamieburchell)

    6 months, 3 weeks ago

    Hi @wfpeter

    The installation is on a VPS that I manage, and it’s the only WordPress installation there. I always setup the auto prepend as a matter of course in the PHP-FPM config – even if the plugin isn’t yet activated. I was just surprised to see files in wflogs without activating the plugin. There’s nowhere else they could have come from other than Wordfence, since they are not part of the files deployed to the server, they were written to by the user PHP runs as and they were created around about the time I ran the WordPress initial setup.

    Plugin Support wfpeter

    (@wfpeter)

    6 months, 3 weeks ago

    Ah, that explains it @jamieburchell.

    Using auto_prepend_file to load the WAF’s bootstrap file allows the WAF code to run before WordPress starts, just like it does when setting it up through the UI. It will create its default files including those in wflogs if they don’t already exist.

    When its configuration files don’t exist yet, the defaults will start it in Learning Mode just as it does when activating the plugin first time.

    Thanks,
    Peter.

    Thread Starter Jamie Burchell

    (@jamieburchell)

    6 months, 3 weeks ago

    Even if the plugin has not been activated yet @wfpeter ? I would expect the plugin to do nothing if it hasn’t been activated, even when including the waf file…

    Plugin Support wfpeter

    (@wfpeter)

    6 months, 3 weeks ago

    Hi @jamieburchell.

    As auto_prepend_file is a PHP directive, it’ll run whatever you put there. When optimizing the firewall rather than running in Basic Protection mode, Wordfence will usually add this as part of the process so would need to be activated at that time. However, if you add it manually yourself, it tells wordfence-waf.php to run after PHP loads, but before anything else including WordPress loads – so it can’t check for whether the plugin is active or not. This is how Wordfence in Extended Protection helps protect your site, as blocked IPs or malicious code will be stopped before anything is served to the browser.

    Thanks again,
    Peter.

    Thread Starter Jamie Burchell

    (@jamieburchell)

    6 months, 3 weeks ago

    @wfpeter Thanks for taking the time to explain. I wasn’t appreciating that wordfence-waf.php can’t check the plugin status due to how early it needs to run. I understand properly now. 🙂

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Files created in wflogs before plugin activated’ is closed to new replies.