Scheduled Scan causes 500 error?

Resolved Liz
(@lizote)

1 month, 1 week ago

We started having a weird issue where every night between 12:30am-12:40am CST our website would start throwing a 500 error for anywhere from 10-15min before going back online again. I assume this is related to Wordfence scanning our website. We are using the free version of Wordfence, so we can’t schedule a time for our scans, but the consistent timing of this outage has me thinking it’s some kind of scheduled process happening.

I’ve tried using low resource scanning just in case it was somehow overloading things, but that actually caused the site to go down and not go back up at all.

The only way to bring the site back online is for me to download the .htaccess file, delete the wordfence chunk, reupload it, refresh the site to ensure it’s back up, then paste the wordfence chunk back in and reupload it.

I’ve tried enabling live traffic for all just to see if there was anything in there that looked concerning, but there wasn’t.

We are currently stuck on an old version of php (7.4) and mysql (5.7), ubuntu 18.04 with apache2 at the moment (working on getting that up to date), but any guidance for narrowing this down so I don’t have to do this every night would be appreciated.

The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)

Plugin Support wfpeter
(@wfpeter)

1 month, 1 week ago

Hi @lizote, thanks for reaching out.

Wordfence’s scheduled scans are staggered by our servers to prevent too many simultaneous requests at our end and their timing can also be different based on when the free plugin was installed. For example, my automatic scan took place at 8:22 this morning.

A large amount of database or file activity (including a Wordfence scan) and a shortage of available resources could cause an issue like the one you describe, but you can get the clearest idea of the cause from your PHP/server logs. At the approximate timestamp of the 500 errors, there should be a more descriptive error/failure in your logs. Your server admin or host may be able to assist if those aren’t easily accessible from your filesystem or control panel. It’s also possible other scheduled tasks on the server like nightly backups could be the cause.

We’ll be happy to look into it further if it looks like Wordfence is causing the issue described in the logs. Feel free to paste the line(s) from the log to assist us.

Thanks,
Peter.

Thread Starter Liz
(@lizote)

1 month, 1 week ago

Thank you for your response. Interestingly, there is no error log for that timestamp, the next closest was from 12:54am, which was a core error for an ip address making an invalid uri request, but I did see several php fatal errors about memory usage exhaustion for wflogs/rules.php from much earlier in the day, which interestingly did not cause outages, so I’ve updated the appropriate files to increase memory usage to 256M. The mystery continues…

Plugin Support wfpeter
(@wfpeter)

1 month ago

Hi @lizote, thanks for clarifying.

If there aren’t any errors logged, it points to the database being completely unreachable or locked. PHP/WordPress often can’t even begin executing enough code to write to the log if it fails at the connection stage before any error handling kicks in. In the case of WordPress, if wp-db.php fails at the connection stage before error_log() is called anywhere then the web server will return a generic 500 response.

It may be possible to troubleshoot whether the database is performing a scheduled backup on itself at that time or what it was trying to do when it locked up or became unresponsive.

I hope that helps you out,
Peter.

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.

Tags