KratosGemini

I exported the report for one of our websites and manually emailed it so I could redact sensitive environment variables and cookies in it before sending.

We are running a fairly recent version of PHP, but we do have aggressive opcache settings.

I can confirm that modal-prompt.php does not exist on my web server.

Environment-based automation is exactly the reason. To avoid unintended side-effects when using staging or local development environments, we have code that detects a non-production environment and disables or reroutes certain features. One of the features that is very important to disable is live email sending. Otherwise, clients could get emails with URLs from our development or staging environments (and to make matters more confusing, these would be duplicate emails).

There are various reasons why unwanted sending of live emails could be triggered on a non-production site without any developer intervention. For example, if there is a process that sends a follow-up email at a certain time (such as paying the balance of a product that had a deposit paid). This has happened before, which is why we included code to disable functions like this.

Our current email plugin has a constant that when defined, does email simulation. So our code sets this constant automatically on non-production environments. Another alternate email plugin I’ve tested out, FluentSMTP, also provides such functionality via an optionally defined constant. However, I’m endeavoring to go with SureMail in the hopes that one day this unrelated feature will be added: https://ideas.suremails.com/boards/feature-requests/posts/permissions-to-view-email-log-for-non-admins. (I’ve asked FluentSMTP about adding that feature, but as of now they have no plans to.) Aside from this email simulation issue, FluentSMTP is equivalent. So my desire to use SureMail is a hope that maybe some day the non-admin email log viewing feature will be added (which would make our lives better). However, not being able to automate the enabling of email simulation is a deal-breaker for switching for us.

Does that help?

Thanks for considering.

P.S. In case it’s not clear, our staging and development environments are copies of our production environments that are refreshed on occasion. This ensures that things like new pages or products make their way over to our staging and development environments. But this also means that those environments contain already in-process real customer interactions. Hence, the issue if delayed emails are sent. Our process makes testing things on other environments very convenient with minimal manual changes, but it has the side-effect of being problematic if certain processes like emails, webhooks, etc. run on those environments without alternations.

• This reply was modified 3 months, 2 weeks ago by KratosGemini. Reason: Added more detail

I tested the PR by copying wp-cache.php to my local install, and I can confirm is solves the cache clear issue I mentioned in this thread. Looking forward to the next release. Until then, we have our mu-plugin workaround.

I installed the new beta version and cleared the caches. I’m still seeing the same issue.

I cleared all the caches after the update (including all transients), and it still does not work.

Thank you for the detailed response, @wfpeter. I appreciate it.

We choose to block rather than throttle 404s because an excessive amount of them almost certainly means a bot is scanning our site for files that don’t exist (usually looking for vulnerabilities) and therefore is malicious. Any normal crawler is not going to run into 404s consistently enough (if at all) to trigger the block.

So that being said, one reason I started this is because I think there may be a bug in Wordfence. I don’t see the benefit in sending multiple emails repeatedly about the exact same block, especially while that block is in effect. But maybe I’m missing something.

For now, I’ll disable those emails to avoid issues with our email sender.

I do still have this question though: Is Wordfence intended to send a slew of duplicate emails whenever an IP address is blocked via the rate limiting?

Thanks.

I do not see a “By ID” option on the product edit page (only adding by URL). This is what I see:

https://imgur.com/a/tFOVGae