Title: Connection refused, referer: https://mydomain/wordfence_syncAttackData=xxxx
Last modified: March 4, 2021

---

# Connection refused, referer: https://mydomain/wordfence_syncAttackData=xxxx

 *  Resolved [fringemedia](https://wordpress.org/support/users/fringemedia/)
 * (@fringemedia)
 * [5 years, 2 months ago](https://wordpress.org/support/topic/connection-refused-referer-https-mydomain-wordfence_syncattackdataxxxx/)
 * I’m running Wordfence on a client site and it’s accumulating several GBs of log
   data every day until the server runs into memory errors.
 * [Thu Mar 04 05:05:32.605870 2021] [fcgid:warn] [pid 2102:tid 139625192437504][
   client IP.ADDRESS.OF.SERVER:41004] mod_fcgid: stderr: Connection refused, referer:
   [https://www.mydomain/?wordfence_syncAttackData=1614834329.5349](https://www.mydomain/?wordfence_syncAttackData=1614834329.5349)
 * Site is running on Plesk – I think this constant writing to logs is also causing
   the site to perform slowly.
 * Has anyone else come across this issue and have any steps to fix?

Viewing 2 replies - 1 through 2 (of 2 total)

 *  Plugin Support [WFAdam](https://wordpress.org/support/users/wfadam/)
 * (@wfadam)
 * [5 years, 2 months ago](https://wordpress.org/support/topic/connection-refused-referer-https-mydomain-wordfence_syncattackdataxxxx/#post-14139186)
 * Hello [@fringemedia](https://wordpress.org/support/users/fringemedia/) and thanks
   for reaching out to us!
 * It is ok to see wordfence_syncAttackData in Live Traffic, but if it’s happening
   for the server’s own IP, you might have something blocked to be causing the sync.
   Currently, if these calls are blocked, the sync will be triggered by visitors
   in the background, similar to loading a javascript file, but with no content 
   returned to the visitor. The visitor sees nothing, and the server will consider
   the data to be “caught up” so it will quit trying to sync on its own until the
   next attack.
 * If there is an attack going on, there should be wordfence_syncAttackData calls
   periodically. This makes me think your site is either constantly getting malicious
   traffic or something is blocked that shouldn’t be.
 * Navigate to **Wordfence > Firewall > Blocking** and see if any IPs are blocked
   with regards to your site or your host.
 * You could also send me a diagnostic so I can confirm your settings are correct.
   Can you send a diagnostic report to **wftest @ wordfence . com**? You can find
   the link to do so at the top of the **Wordfence Tools > Diagnostics** page. Then
   click on **“Send Report by Email”**. Please add your forum username where indicated
   and _respond here after you have sent it._
 * Thanks again!
 *  Thread Starter [fringemedia](https://wordpress.org/support/users/fringemedia/)
 * (@fringemedia)
 * [5 years, 1 month ago](https://wordpress.org/support/topic/connection-refused-referer-https-mydomain-wordfence_syncattackdataxxxx/#post-14364286)
 * Hi Adam, sorry for the late reply – turned out the issue was due to an object
   cache with the caching plugin and not WordFence!
 * Thanks so much for the quick reply here.
 * All the best.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Connection refused, referer: https://mydomain/wordfence_syncAttackData
=xxxx’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 2 replies
 * 2 participants
 * Last reply from: [fringemedia](https://wordpress.org/support/users/fringemedia/)
 * Last activity: [5 years, 1 month ago](https://wordpress.org/support/topic/connection-refused-referer-https-mydomain-wordfence_syncattackdataxxxx/#post-14364286)
 * Status: resolved