Any good reason why we would be getting this Wordfence critical warning since the most recent Enfold update?
Critical Problems:
* File appears to be malicious: wp-content/themes/enfold/includes/admin/demo_files/creative-studio.xml
Hello, I have disbaled Wordfence and it still doesn’t work. I then also disabled all plugins and still no Enfold update.
How to proceed?
Thank you,
Alwin
Hi,
From the plugins, check if any plugin like wordfence for example.
Best regards,
Basilis
Hi Nikko
I tried the following:
1. Flushed cache, de-activated the WP Rocket plugin and put Wordfence into learning mode but still not able to get the API key accepted.
2. Created & tried a new API key (for the same Mailchimp account) and no luck.
3. Created & tried a new API key in a different Mailchimp account – also no luck / progress
4. De-activated Wordfence plugin – no change
Do you have any other suggestions which I can try?
Thanks John
Hi JohnMYates,
Thanks for giving us admin access.
I tested your mailchimp api key on my end and it works, also tested my mailchimp api key which works on my end but it also gets Could not connect to Mailchimp with this API Key. Please try again with a different key. Can you try if it works if you flush out cache and disable wp rocket and put wordfence in learning mode?
Best regards,
Nikko
Hi,
Thanks for that, though I’m getting blocked by Wordfence:
Your access to this site has been limited
Your access to this service has been temporarily limited. Please try again in a few minutes. (HTTP response code 503)
Reason: Advanced blocking in effect.
Could you disable that until we have helped you please? If not then please list which countries are allowed and I’ll assign this ticket to moderators located in those countries.
Best regards,
Rikard
I just updated 10 sites with the 4.6.1 update that was available on Themeforest.
Now I’m getting Wordfence warnings I need to update to 4.6.1? I even checked the change log included before I updated. What’s up with this?
Also, the Enfold Theme update panel reported I had 4.6 installed after I installed 4.6.1.
-
This topic was modified 6 years, 3 months ago by
crtdude.
Hi maryenvato,
I apologize for the delay and I was locked out by Wordfence when I attempted to login (2 attempts):
You are temporarily locked out
You have been temporarily locked out of this system. This means that you will not be able to log in for a while.
As for adding h1 to text, which is a menu link isn’t recommended, no issues for it visually but it’s not a good practice or atleast in terms of seo.
As for your other site, it might not be showing due to caching from siteground, you may need to flush out cache to see the changes.
Best regards,
Nikko
I have found the problem. It was a plugin called Wordfence. I had all plugins deactivated but even having this one installed was causing the problem. Once I deleted it, everything worked.
Hello,
Wordfence is flagging this file as malicious, I am just checking to see if it is an enfold file or something that shouldn’t belong:
Filename: wp-content/themes/enfold/framework/php/function-set-avia-backend.php
File Type: Not a core, theme, or plugin file from wordpress.org.
Thanks,
Jim
Hi OMALeaders,
Yes, I have removed it, sorry was trying to debug it but lost connection.
Tried to create a test page testing each section which works but if combined it admin-ajax returns a 404 error.
This usually happens on wordfence but you don’t have one, can we ask for ftp access? so we can check further and maybe have some lead to what’s causing the issue.
Best regards,
Nikko
Hello,
when I try to enable the custom maintenance page, I cannot see any pulldown menu below. There is only a small bar where my cursor changes but nothing happens when I click on it.
Inside the them options I also cannot edit the setting of the start page or the blog.
…even this topic does not help:You are here:Home / Forums / Enfold / Problem maintenance mode with Enfold 4.5.4
In the line there is another content: if( true !== apply_filters( ‘avf_forced_reroute_to_404’, true, $original_template, $id, $special_pages ) )
The only plugin is wordfence.
Right now it means that I cannot use it.
I use Enfold 4.5.7.
best regards
Cay
-
This topic was modified 6 years, 4 months ago by
cazkruse.
Hi,
Thanks for that, though I’m being blocked by Wordfence. Could you disable that until we have helped you out please?
Best regards,
Rikard
Hi DesignUM_International,
Please deactivate all plugins one by one to check which one is causing this issue and let us know if this solves the problem. Especially, WOrdfence or something of the kind.
Best regards,
Victoria
Hi jasperfoto,
I apologize I missed it :(
This is now fixed, I have found this .htaccess file in your uploads folder, I just renamed it to dothtaccess so it doesn’t run.
I think this code is autogenerated and is similar to what is posted in the wordfence thread: https://wordpress.org/support/topic/wordfence-code-execution-protection-blocks-images/
Best regards,
Nikko
Sorry about that, Rikard!
I’ve disabled country-level blocking, so you shouldn’t have trouble now.
If Wordfence blocks you again for another reason, let me know and I’ll disable it entirely.
Hi,
Thanks for the details, though I’m getting blocked by Wordfence. Could you disable that until we have helped you out please?
Best regards,
Rikard
WordFence author gave me a simple piece of php.ini code to turn something off that managed to fix the issue.
Turned out that autoptimize was also creating problems and that theme author told me to deselect “optimize excluded css/js script”
That fixed the issue altogether. At least for now . . . fingers crossed!
Jon
I guess it was the “wordfence” plugin. I desactivated it.. you can login now
Thanks!
Hi Ismael,
The trouble with disabling plugins is that the issue I am concerned about is when my site is crawled by Google Bot, and I don’t know when that happens, so I’d have to leave some pretty important plugins disabled. I am going to go look thru my plugins to see if there are any others I can temporarily disable (like wordfence) that might help.
I am about to email my host support to ask about the ajax issue. Really appreciate the help here.
Jon
Hi,
Have you tried to temporarily disable the plugins including WordFence? And if I am not mistaken, your server is blocking the admin-ajax.php file according to the error logs. Please ask your host if they can rule out this file.
[Sat Jun 08 10:32:50 2019] [error] [client 93.85.78.188] ModSecurity: Access denied with code 418 (phase 1). Pattern match “^Mozilla/5.0 \\(Windows NT 6.1; WOW64; rv:40.0\\) Gecko/20100101 Firefox/40.1$” at REQUEST_HEADERS:User-Agent. [file “/dh/apache2/template/etc/mod_sec2/99_dreamhost_rules.conf”] [line “345”] [id “1990098”] [msg “Malicious Bot UA”] [hostname “gatehealing.com”] [uri “/wp-login.php”] [unique_id “XPvxQq3srLoAABdq-JsAAAAJ”]
[Sat Jun 08 10:32:51 2019] [error] [client 93.85.78.188] ModSecurity: Access denied with code 418 (phase 1). Pattern match “^Mozilla/5.0 \\(Windows NT 6.1; WOW64; rv:40.0\\) Gecko/20100101 Firefox/40.1$” at REQUEST_HEADERS:User-Agent. [file “/dh/apache2/template/etc/mod_sec2/99_dreamhost_rules.conf”] [line “345”] [id “1990098”] [msg “Malicious Bot UA”] [hostname “gatehealing.com”] [uri “/”] [unique_id “XPvxQ63srLoAAALHKIAAAAAI”]
Best regards,
Ismael
I’m not sure what folder/file permissions I would’ve changed? The only change I have made that might relate is that my username for my server was set as SFTP user – allows login via SFTP (SSH file transfer) for file transfers only, then I changed it to Shell user – allows login via SSH (secure shell) for command-line access, as well as SFTP (was hoping that would help me access some error logs as per some of their instructions)
But I changed it back.
Wordfence and all other plugins are updated. I’m not sure how to check and see if any files are corrupted, but I’ll send this info along to my host as well.
J
I have disabled WordFence.
Hi,
It seems that WordFence has locked me out, please check.
Please see this post about getting your Token
Best regards,
Mike
Hi,
[Sat Jun 08 06:42:33 2019] [warn] [client 66.102.9.24] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Sat Jun 08 06:42:33 2019] [error] [client 66.102.9.24] Premature end of script headers: index.php
[Sat Jun 08 07:31:33 2019] [warn] [client 66.249.79.110] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Sat Jun 08 07:31:33 2019] [error] [client 66.249.79.110] Premature end of script headers: index.php
The error above is what we and your hosting provider should try to resolve. According to some threads, it could be related to the folder and file permissions. Did you change any of that?
// https://www.smashingmagazine.com/2014/05/proper-wordpress-filesystem-permissions-ownerships/
The errors also involves the WordFence plugin, so you might want to check that as well. Make sure that the plugins are updated and that the files aren’t corrupted.
[Sat Jun 08 09:17:53 2019] [warn] [client 2607:f298:5:102f::ffc:e442] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server, referer: https://gatehealing.com/wp-admin/admin-ajax.php?action=wordfence_testAjax
[Sat Jun 08 09:17:53 2019] [error] [client 2607:f298:5:102f::ffc:e442] Premature end of script headers: admin-ajax.php, referer: https://gatehealing.com/wp-admin/admin-ajax.php?action=wordfence_testAjax
Best regards,
Ismael
Phoenix
Hi Mike,
Thank you very much for your response and insight. Sorry if this is a stupid question, but if I buy Enfold and make it the Theme, would I have to recreate the website?
As far as the attacks go, it seems like we are just getting a lot of spam injected into our pages and portfolio items. It seems like they are injecting some java scripts and it redirects people to spammy websites. Another issue is that we cannot update our site to the most recent php version because the Angular Theme isn’t compatible with it. We currently have Angular 2.0 and I’m not sure if there is any more recent version than that.
We have looked into Sucuri and Wordfence and will probably end up buying Sucuri to protect our site and clean the spam/viruses.
We probably will end up updating to the Enfold theme but like I mentioned before, I am it’s curious if I’ll have to completely create the website from scratch again.
Thank you,
Phoenix
Hi TJ,
I’m getting locked out from Wordfence, could you lift the restrictions in the plugin until we have helped you out?
Best regards,
Rikard
I have temporarily disabled Wordfence.
Hey Daisy,
Thanks for the details, though I’m getting blocked by Wordfence. Could you disable that temporarily please?
Best regards,
Rikard
I am not sure if my problem is related.
Two days age two of our shop managers reported that they cannot edit tabs in ALB. Today when I (administrator) try to edit tabs I got a warning about the action “wp-admin/admin-ajax.php?_fs_blog_admin=true” was blocked from Wordfence. I think it is the reason the shop managers cannot edit tabs in ALB.
Is it safe to set “/wp-admin/admin-ajax.php?_fs_blog_admin=true” white list?