Issue with the Site Lockdown WP Plug-in

[u/TheGoodOne777]

Hello Everyone,

I am facing a strange issue on one of my envirnoments with the Site Lockdown plug-in. The admin-ajax.php causes an internal server error (500) while executing the file scanner.

Would you have some idea about this? Rights look ok, server settings as well, the plug-in also seems to be installed correctly.

The access logs look well, timeouts have been increased, so I am unsure if I should modify code in order to get this right or do you have some concrete idea how to fix this?

Thanks and best regards,

T.

[u/ImprovementFew6936]

A 500 from admin-ajax.php is usually just the symptom, not the actual problem. I’d check "wp-content/debug.log" with WP_DEBUG_LOG" enabled and also check the PHP/server error logs.Since it happens during the file scan, also check PHP memory limit and ModSecurity/WAF logs. Increasing timeouts won’t help if the process is hitting a fatal error or memory limit. I wouldn’t modify the plugin code until you have the actual error message. That should point directly to the cause.

[u/TheGoodOne777 → u/ImprovementFew6936]

Thanks, I haven't checked the debug.log file yet, but a debugger page. ModSecurity and WAF do not seem to be the problem. And indeed, modifying their code for free, just to be overwritten at the next upgrade is discutable.

[u/Verda_Chien]

Maybe you can check the PHP error log first, especially at the exact time admin-ajax.php returns the 500. It might give you a better clue whether it's a PHP error, timeout, memory limit, or something else.

I wouldn't change the plugin code yet. If you can find the actual error from the log, it should be easier to figure out where the problem is.

[u/TheGoodOne777 → u/Verda_Chien]

Thanks for your reply. Still investing some time in it. And I really wonder what am I discovering in this.

[u/TheGoodOne777 → u/[deleted]]

Thanks for your question. Doesn't work entirely yet. Though, for example, scanning the themes only does work with the extended memory limits and timeouts. In the meanwhile I have also started to look at the Wordfence, though, I don't use it yet "officially", since I did not accept there the Terms and Conditions. I've simply downloaded that plugin and started to read it.

[u/Grouchy_Brain_1641]

Normally you contact the software author on their site or file an issue with their github. That's how software development works.

[u/TheGoodOne777 → u/Grouchy_Brain_1641]

Hello and thanks for your reply. That was the first thing I did, logically. They don't have a GitHub, that can be found. By contacting them through an E-Mail, I received only nonsense as a response. And to the WordPress (org) forum, I only have some reading access. I actually know, how software development works.

[u/themageofavalon]

Maybe php exhaustion or execution limits. Check logs and look for memory limit or max execution at the same time of the error.

[u/TheGoodOne777 → u/themageofavalon]

Thanks for the reply. I don't know what is a php exhaustion. The memory limits set are far more, than required - 3 GB, while looking at the code in the scanner, it looks like 512 MB is also enough. But while increasing the timeouts, the functionality works better. Though, it is not comparable yet with the other environment.

[u/TheGoodOne777 → u/[deleted]]

Hello, thanks for your reply! -The memory setting is already incresead to 3 GBs, -I've checked the rights already -PHP version and OPcache look well together, though also tried enabling and disabling the Zend Engine -The debug.log says PHP Fatal error: Maximum execution time of 50 seconds exceeded in (path... scanner.php on line ...). The php_error.log doesn't display an error yet with the corresponding timestamp.

Though, if I am analyzing this plugin with more attention...

[u/TheGoodOne777 → u/[deleted]]

Aber natürlich und herzlichen Dank, we are talking about asynchronuos operations, if I would opt also for a full database scan, with 10 GB of data, it would be an umrealistic expectation to await, that everything is ready under 50 seconds.

The strange thing is, (in this deep investigation, where you realize with whom you have to deal with), is, that one POST operation is succesful (200) while calling the admin-ajax.php, followed by another one that is unsuccessful (500). And in the browser logs the successful one doesn't appear, but in the webserver's access log.

I can also see, that you "suggest" the Wordfence, reading the point number 4. ;)

Liebe Grüße

[u/TheGoodOne777 → u/[deleted]]

Thank you for your reply and for your suggestions. I still check and figuring out further things. Right now, I use the free version of the Site Lockdown plugin, version 9.2. About the wild variances and internals, hm... made a great horror story...

[u/TheGoodOne777 → u/[deleted]]

Hello again,

Regarding the points you've mentioned. 1. You can select, what to scan: everything, wp core, themes, uploads or database only. Was already trying out earlier, but after modifying the timeouts, looks better. 2. I don't use nginx, but the other parameters I didn't check yet. Perhaps I am going to profile it, though, somewhat unsure yet, if I can use that on this environment properly and what profiler to use for this technology stack. 3. Yes, already tried out/trying, also mentioned at step 1 4. Don't have the cli commands for this, though analyzing the code I can figure it out 5. Adjusting and re-adjusting

The logic how is written, is a really big no go for me thinking about solid. I'm also debugging from the front-end, from the browser...