Connection refused, referer: https://mydomain/wordfence_syncAttackData=xxxx

  • Resolved fringemedia

    (@fringemedia)


    5 years, 2 months ago

    I’m running Wordfence on a client site and it’s accumulating several GBs of log data every day until the server runs into memory errors.

    [Thu Mar 04 05:05:32.605870 2021] [fcgid:warn] [pid 2102:tid 139625192437504] [client IP.ADDRESS.OF.SERVER:41004] mod_fcgid: stderr: Connection refused, referer: https://www.mydomain/?wordfence_syncAttackData=1614834329.5349

    Site is running on Plesk – I think this constant writing to logs is also causing the site to perform slowly.

    Has anyone else come across this issue and have any steps to fix?

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support WFAdam

    (@wfadam)

    5 years, 2 months ago

    Hello @fringemedia and thanks for reaching out to us!

    It is ok to see wordfence_syncAttackData in Live Traffic, but if it’s happening for the server’s own IP, you might have something blocked to be causing the sync. Currently, if these calls are blocked, the sync will be triggered by visitors in the background, similar to loading a javascript file, but with no content returned to the visitor. The visitor sees nothing, and the server will consider the data to be “caught up” so it will quit trying to sync on its own until the next attack.

    If there is an attack going on, there should be wordfence_syncAttackData calls periodically. This makes me think your site is either constantly getting malicious traffic or something is blocked that shouldn’t be.

    Navigate to Wordfence > Firewall > Blocking and see if any IPs are blocked with regards to your site or your host.

    You could also send me a diagnostic so I can confirm your settings are correct. Can you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    Thanks again!

    Thread Starter fringemedia

    (@fringemedia)

    5 years, 1 month ago

    Hi Adam, sorry for the late reply – turned out the issue was due to an object cache with the caching plugin and not WordFence!

    Thanks so much for the quick reply here.

    All the best.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Connection refused, referer: https://mydomain/wordfence_syncAttackData=xxxx’ is closed to new replies.