Security Issue – user.ini file

  • Resolved Learner

    (@newest)


    5 years, 9 months ago

    Hi !

    I have recently shifted a WordPress site to Google Cloud. It uses Litespeed .

    Wordfence is giving me a warning that .user.ini is publicly accessible. I have checked and it is.

    https://ww.wp.xz.cn/support/topic/security-issue-user-ini-file/
    tells me to put this code in .htaccess file :
    ====
    <Files “.user.ini”>
    <IfModule mod_authz_core.c>
    Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
    </IfModule>
    </Files>
    ====

    But this code already exists in .htaccess file !

    Please advise, thank you.

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Support wfphil

    (@wfphil)

    5 years, 9 months ago

    Hi @newest

    If you let your hosting provider know that the .user.ini file is publicly accessible then they can prevent that for you.

    Thread Starter Learner

    (@newest)

    5 years, 8 months ago

    I am a free trial user of Google Cloud presently and tech support is not available to me.

    Do you have any suggestions I can try on my own ? Thanks !

    Plugin Support wfphil

    (@wfphil)

    5 years, 8 months ago

    Hi @newest

    I would like to have a look at your Wordfence diagnostics report. Please go to the top of the “Diagnostics” tab on the Wordfence “Tools” page. There will be a “SEND REPORT BY EMAIL” button to send the diagnostics report. Enter wftest [at] wordfence [dot] com as the email and @newest as the forum username please.

    Once you have emailed me the diagnostics report can you reply here to let me know that it has been sent. This is important in the unlikely event that your installation of WordPress is having an issue with sending mail.

    Thread Starter Learner

    (@newest)

    5 years, 8 months ago

    Hi @wfphil

    Thanks. Have done as you suggest.

    However, it is possible that e-mail is not working since some forms that I had made on the site using a forms plugin that e-mailed results to me have stopped working since I shifted to google cloud. Please check and let me know, thanks.

    Thread Starter Learner

    (@newest)

    5 years, 8 months ago

    OK, I have sent a test mail from that diagnostics tab ( other tests section ) to myself and have received the same in my email account. So perhaps there are no e-mail problems.

    Plugin Support wfphil

    (@wfphil)

    5 years, 7 months ago

    Hi

    Thank you for sending the report.

    It appears that you are using an OpenLiteSpeed that doesn’t support the use of .user.ini or .htaccess files so your .user.ini file may have been copied over as part of a migration of your website and can be removed.

    To optimize the firewall you can use this guide here in the Sites using OpenLiteSpeed section:

    https://www.wordfence.com/help/firewall/optimizing-the-firewall/troubleshooting/

    Thread Starter Learner

    (@newest)

    5 years, 4 months ago

    OK noted, will work on it and revert if any issue. Thanks VERY much for all your help and inputs.

    Plugin Support wfphil

    (@wfphil)

    5 years, 4 months ago

    Hi @newest

    You’re welcome!

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Security Issue – user.ini file’ is closed to new replies.

Tags