Skip to content

Commit 73ff50e

Browse files
whitneymeredithwhitneymeredith
authored
Merge pull request #8027 from pantheon-systems/8025-wordfence-symlinks
wordfence symlinks tweak
2 parents 24308cb + 22dc5da commit 73ff50e

File tree

1 file changed

+86
-71
lines changed

1 file changed

+86
-71
lines changed

‎source/content/plugins-known-issues.md‎

Lines changed: 86 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ The following is a list of plugins that assume write access, and the specific fi
3434
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
3535
| Plugin | Assumed Write Path | Notes |
3636
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
37-
| [AccessAlly WordPress LMS](https://accessally.com/) | wp-content/accessally-protected-content | `PROTECTED_CONTENT_FOLDER` variable within the plugin assumes access to `PATH` |
37+
| [AccessAlly WordPress LMS](https://accessally.com/) | wp-content/accessally-protected-content | `PROTECTED_CONTENT_FOLDER` variable within the plugin assumes access to `PATH` |
3838
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
3939
| | wp-content/ai1vm-backups | The platform is not designed for large backup files, and this plugin can cause |
4040
| | | your deployment workflows to break. You can download full backups |
@@ -58,6 +58,8 @@ The following is a list of plugins that assume write access, and the specific fi
5858
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
5959
| [WooZone](https://codecanyon.net/item/woocommerce-amazon-affiliates-wordpress-plugin/3057503) | wp-content/plugins/woozone/cache | |
6060
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
61+
| [Wordfence](https://wordpress.org/plugins/wordfence/) | wp-content/wflogs | Follow the steps outlined in the [Wordfence](#wordfence) section. |
62+
+-----------------------------------------------------------------------------------------------+-------------------------------------------------------+--------------------------------------------------------------------------------------------------+
6163
| [WP Fastest Cache](https://wordpress.org/plugins/wp-fastest-cache/) | wp-content/cache | This plugin uses `is_dir` to verify the target directory, which will return |
6264
| | |false if the directory is a symlink. This causes a permissions error when |
6365
| | | deleting cache files. |
@@ -1000,15 +1002,19 @@ ___
10001002

10011003
## Wordfence
10021004

1003-
<ReviewDate date="2020-07-15" />
1005+
<ReviewDate date="2022-12-16" />
1006+
1007+
**Issue 1:** Wordfence can't write configuration and log files to the codebase.
10041008

1005-
**Issue:** [Wordfence](https://wordpress.org/plugins/wordfence/) assumes write access to several files in the codebase to store configuation and log files.
1009+
[Wordfence](https://wordpress.org/plugins/wordfence/) assumes write access to several files in the codebase to store configuration and log files.
10061010

10071011
**Solution:** Prepare your environment before installing Wordfence with the proper symlinks and configuration files:
10081012

1013+
<Accordion title="Wordfence Assumed Write Access Solution" id="wordfence-assumed-write-access">
1014+
10091015
<Alert title="Exports" type="export">
10101016

1011-
This process uses [Terminus](/terminus) commands. Before we begin, set the variables `$site` and `$env` in your terminal session to match your site name and the Dev (or [Multidev](/guides/multidev)) environment:
1017+
This process uses [Terminus](/terminus) commands. Before we begin, set the variables `SITE` and `ENV` in your terminal session to match your site name and the Dev (or [Multidev](/guides/multidev)) environment:
10121018

10131019
```bash{promptUser: user}
10141020
export SITE=yoursitename
@@ -1017,7 +1023,7 @@ export ENV=dev
10171023

10181024
</Alert>
10191025

1020-
1. Set your Dev (or [Multidev](/guides/multidev)) environment to [Git connection mode](/guides/quickstart/connection-modes):
1026+
1. Set your Dev (or [Multidev](/guides/multidev)) environment to [Git connection mode](/guides/quickstart/connection-modes) in the dashboard or via Terminus:
10211027

10221028
```bash{promptUser: user}
10231029
terminus connection:set $SITE.$ENV git
@@ -1029,25 +1035,24 @@ export ENV=dev
10291035
git clone ssh://codeserver.dev.xxx@codeserver.dev.xxx.drush.in:2222/~/repository.git my-site
10301036
```
10311037

1032-
1. Change to the `my-site` directory:
1038+
1. Change to the site's `wp-content` directory:
10331039

10341040
```bash{promptUser: user}
1035-
cd /my-site
1041+
cd $SITE/wp-content
10361042
```
10371043

1038-
1. Create the following symlinks:
1039-
1040-
<Alert title="Note" type="info" >
1044+
1. If `/wp-content/wflogs` exists, remove it before you create the symlinks in the next steps:
10411045

1042-
You must remove the `/wp-content/wflogs` directory, if it already exists, before you create the symlinks listed below.
1046+
```bash{promptUser: user}
1047+
rm wflogs
1048+
```
10431049

1044-
</Alert>
1050+
1. Create the following symlinks:
10451051

10461052
```bash{promptUser: user}
1047-
1048-
ln -s ../../files/private/wflogs ./wp-content/wflogs
1049-
ln -s ../files/private/wordfence-waf.php ./wordfence-waf.php
1050-
ln -s ../files/private/.user.ini ./.user.ini
1053+
ln -s ../../files/private/wflogs ./wflogs
1054+
ln -s ../../files/private/wordfence-waf.php ./../wordfence-waf.php
1055+
ln -s ../../files/private/.user.ini ./../.user.ini
10511056
```
10521057

10531058
1. Open `pantheon.yml` and add a [protected web path](/guides/secure-development/private-paths) for `.user.ini`:
@@ -1092,7 +1097,7 @@ Complete this step in Dev, Test, and Live Environments.
10921097
exit
10931098
```
10941099

1095-
1. Set the environment connection mode to SFTP, then install and activate Wordfence. You can do both with Terminus:
1100+
1. Set the environment [connection mode to SFTP](/cms-admin#sftp-mode), then install and activate Wordfence. You can do both with Terminus:
10961101

10971102
```bash{outputLines: 2,4-25}
10981103
terminus connection:set $SITE.$ENV sftp
@@ -1120,98 +1125,104 @@ Complete this step in Dev, Test, and Live Environments.
11201125

11211126
1. Navigate to the **Wordfence** plugin in the site's WordPress Admin and **Resume Installation** if prompted, or click **CLICK HERE TO CONFIGURE**. The plugin requires that you download `.user.ini` to continue. As this file is blank at this point, you can delete it after downloading.
11221127

1123-
**Issue:** Occassionally, when configuring the Web Application Firewall (WAF), it can result in an "Error connecting to the database" message, in which the Wordfence plugin generates a bad `wordfence-waf.php` file. This results in two problems:
1128+
</Accordion>
11241129

1125-
* __DIR__ is not providing the proper path for Wordfence
1126-
* Wordfence cannot find your database credentials
1130+
**Issue 2:** Error connecting to the database.
11271131

1128-
**Solution:** To address the first problem you can modify Wordfence to use relative paths. Change the following code within `wordfence-waf.php` over SFTP
1129-
from:
1132+
Occassionally, when configuring the Web Application Firewall (WAF), it can result in an "Error connecting to the database" message, in which the Wordfence plugin generates a bad `wordfence-waf.php` file. This results in two problems:
11301133

1131-
```
1132-
if (file_exists(__DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1133-
define("WFWAF_LOG_PATH", __DIR__.'/wp-content/wflogs/');
1134-
include_once __DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php';
1135-
}
1136-
```
1137-
to:
1134+
- `__DIR__` is not providing the proper path for Wordfence
1135+
- Wordfence cannot find your database credentials
11381136

1139-
```
1140-
if (file_exists('../../code/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1141-
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');
1142-
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
1143-
}
1144-
```
1137+
**Solution if `__DIR__` is not providing the proper path for Wordfence:** Modify Wordfence to use relative paths.
11451138

1146-
Next, add [Wordfence constants](https://www.wordfence.com/help/advanced/constants/) in between conditions in the `wordfence-waf.php` file. The file should resemble the following when complete:
1139+
1. Change the following code within `wordfence-waf.php` over SFTP from:
11471140

1148-
```
1149-
// Before removing this file, please verify the PHP ini setting `auto_prepend_file` does not point to this.
1150-
// This file was the current value of auto_prepend_file during the Wordfence WAF installation
1141+
```php:title=wordfence-waf.php
1142+
if (file_exists(__DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1143+
define("WFWAF_LOG_PATH", __DIR__.'/wp-content/wflogs/');
1144+
include_once __DIR__.'/wp-content/plugins/wordfence/waf/bootstrap.php';
1145+
}
1146+
```
11511147

1152-
if (file_exists('/includes/prepend.php')) {
1153-
include_once '/includes/prepend.php';
1154-
}
1148+
To:
11551149

1156-
define('WFWAF_DB_NAME', $_ENV['DB_NAME']);
1157-
define('WFWAF_DB_USER', $_ENV['DB_USER']);
1158-
define('WFWAF_DB_PASSWORD', $_ENV['DB_PASSWORD']);
1159-
define('WFWAF_DB_HOST', $_ENV['DB_HOST'] . ':' . $_ENV['DB_PORT']);
1160-
define('WFWAF_DB_CHARSET', 'utf8mb4');
1161-
define('WFWAF_DB_COLLATE', '');
1162-
// Note the table prefix should reflect your WordPress application's table prefix. Update accordingly.
1163-
define('WFWAF_TABLE_PREFIX', 'wp_');
1150+
```php:title=wordfence-waf.php
1151+
if (file_exists('../../code/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1152+
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');
1153+
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
1154+
}
1155+
```
11641156

1165-
if (file_exists('../../code/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1166-
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');
1167-
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
1168-
}
1169-
```
1157+
1. Add [Wordfence constants](https://www.wordfence.com/help/advanced/constants/) in between conditions in the `wordfence-waf.php` file. The file should resemble the following when complete:
1158+
1159+
```php:title=wordfence-waf.php
1160+
// Before removing this file, please verify the PHP ini setting `auto_prepend_file` does not point to this.
1161+
// This file was the current value of auto_prepend_file during the Wordfence WAF installation
1162+
1163+
if (file_exists('/includes/prepend.php')) {
1164+
include_once '/includes/prepend.php';
1165+
}
1166+
1167+
define('WFWAF_DB_NAME', $_ENV['DB_NAME']);
1168+
define('WFWAF_DB_USER', $_ENV['DB_USER']);
1169+
define('WFWAF_DB_PASSWORD', $_ENV['DB_PASSWORD']);
1170+
define('WFWAF_DB_HOST', $_ENV['DB_HOST'] . ':' . $_ENV['DB_PORT']);
1171+
define('WFWAF_DB_CHARSET', 'utf8mb4');
1172+
define('WFWAF_DB_COLLATE', '');
1173+
// Note the table prefix should reflect your WordPress application's table prefix. Update accordingly.
1174+
define('WFWAF_TABLE_PREFIX', 'wp_');
1175+
1176+
if (file_exists('../../code/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1177+
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');
1178+
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
1179+
}
1180+
```
11701181

11711182
#### Further Considerations with Wordfence: Utilizing data storage over files
11721183

11731184
If you experience degraded performance with Wordfence active, using [Wordfence's data storage option](https://www.wordfence.com/help/firewall/mysqli-storage-engine/) might be appropriate. Modify `wordfence-waf.php` to include the MySQLi storage engine constant. Combined with the constants previously mentioned, the plugin will write to your database instead of your file system. If you do this, we recommend wrapping the constants in a condition that checks `wp-config.php` for a conflicting constant. The end result of your modified `wordfence-waf.php` should resemble the following:
11741185

1175-
```
1186+
```php:title=wp-config.php
11761187
<?php
11771188
// Before removing this file, please verify the PHP ini setting `auto_prepend_file` does not point to this.
11781189
// This file was the current value of auto_prepend_file during the Wordfence WAF installation (Sun, 21 Nov 2021 23:40:56 +0000)
11791190
11801191
if (file_exists('/includes/prepend.php')) {
1181-
include_once '/includes/prepend.php';
1192+
include_once '/includes/prepend.php';
11821193
}
11831194
11841195
if(! defined('WFWAF_STORAGE_ENGINE')) {
1185-
// define WF constants if not set in wp-config.php
1186-
define('WFWAF_STORAGE_ENGINE', 'mysqli');
1187-
define('WFWAF_DB_NAME', $_ENV['DB_NAME']);
1188-
define('WFWAF_DB_USER', $_ENV['DB_USER']);
1189-
define('WFWAF_DB_PASSWORD', $_ENV['DB_PASSWORD']);
1190-
define('WFWAF_DB_HOST', $_ENV['DB_HOST'] . ':' . $_ENV['DB_PORT']);
1191-
define('WFWAF_DB_CHARSET', 'utf8mb4');
1192-
define('WFWAF_DB_COLLATE', '');
1196+
// define WF constants if not set in wp-config.php
1197+
define('WFWAF_STORAGE_ENGINE', 'mysqli');
1198+
define('WFWAF_DB_NAME', $_ENV['DB_NAME']);
1199+
define('WFWAF_DB_USER', $_ENV['DB_USER']);
1200+
define('WFWAF_DB_PASSWORD', $_ENV['DB_PASSWORD']);
1201+
define('WFWAF_DB_HOST', $_ENV['DB_HOST'] . ':' . $_ENV['DB_PORT']);
1202+
define('WFWAF_DB_CHARSET', 'utf8mb4');
1203+
define('WFWAF_DB_COLLATE', '');
11931204
// Note this table prefix should reflect your WordPress application's table prefix. Update accordingly.
1194-
define('WFWAF_TABLE_PREFIX', 'wp_');
1205+
define('WFWAF_TABLE_PREFIX', 'wp_');
11951206
}
11961207
11971208
if (file_exists('../../code/wp-content/plugins/wordfence/waf/bootstrap.php')) {
1198-
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');;
1199-
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
1209+
define("WFWAF_LOG_PATH", '../../code/wp-content/wflogs/');;
1210+
include_once '../../code/wp-content/plugins/wordfence/waf/bootstrap.php';
12001211
```
12011212

1202-
**Advantages:** Customers have reported improved file system performance, while not having to compromise on Wordfence's features.
1213+
**Advantages:** Customers have reported improved file system performance without having to compromise on Wordfence's features.
12031214

12041215
**Disadvantages:** Due to the nature of the plugin, binary logs and insertion queries will increase. Performance gains in one area may be sacrificed in another.
12051216

12061217
#### How do I confirm I am using data storage with Wordfence?
12071218

1208-
You can confirm usage by navigating to the Wordfence menu within your WordPress dashboard. Select **Tools**, on the the Tools page click the **Diagnostic** tab. In the **Diagnostic** tab, below the **Wordfence Firewal** section, search for the "Active Storage Engine". This query will display either "File System" or "MySQLi". For this instance, choose "MySQLi". An additional table will be added called `wp_wfwafconfig` (assuming your table prefix is wp_) and queries will increase based on blocked traffic.
1219+
You can confirm usage by navigating to the Wordfence menu within your WordPress dashboard. Select **Tools**, on the the Tools page click the **Diagnostic** tab. In the **Diagnostic** tab, below the **Wordfence Firewal** section, search for the "Active Storage Engine". This query will display either "File System" or "MySQLi". For this instance, choose "MySQLi". An additional table will be added called `wp_wfwafconfig` (assuming your table prefix is `wp_`) and queries will increase based on blocked traffic.
12091220

12101221
___
12111222

12121223
## WordPress Download Manager
12131224

1214-
**Issue 1:** The [WordPress Download Manager](https://www.wpdownloadmanager.com/) plugin `wpdm-cache` directory may grow excessively large with generated files.
1225+
**Issue:** The [WordPress Download Manager](https://www.wpdownloadmanager.com/) plugin `wpdm-cache` directory may grow excessively large with generated files.
12151226

12161227
**Solution:** We recommend that you research an alternative download manager plugin that fits your needs.
12171228

@@ -1468,6 +1479,7 @@ ___
14681479
1. Create a symlink for `wp-content/languages` pointing to `wp-content/uploads/languages`. See [Using Extensions That Assume Write Access](/symlinks-assumed-write-access) for more information.
14691480

14701481
1. Define the [FS_METHOD in the wp-config](#define-fs_method).
1482+
14711483
___
14721484

14731485
## YITH WooCommerce Request a Quote
@@ -1491,7 +1503,9 @@ if ( ! function_exists( 'ywraq_mpdf_change_tmp_dir' ) ) {
14911503
}
14921504
}
14931505
```
1506+
14941507
___
1508+
14951509
## Yoast SEO
14961510

14971511
<ReviewDate date="2018-06-12" />
@@ -1501,6 +1515,7 @@ ___
15011515
**Solution:** Only use the "PHP" redirect method.
15021516

15031517
___
1518+
15041519
## Yoast Indexables
15051520

15061521
<ReviewDate date="2022-06-14" />

0 commit comments

Comments
 (0)