WP Manifestindependent plugin directory
manifest / security / wordfence-blockings-log

Wordfence blockings log WP RegistryLow-severity findings · 1 findingOpen the reportA-

Wordpress Wordfence blockings log

by Cyrille37 · github.com/cyrille37/wordfence-blockings-log · website

★ 3stars
v1.0.1latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cyrille37/wordfence-blockings-log/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/cyrille37/wordfence-blockings-log ↗

Wordpress Wordfence blockings log

A Wordpress plugin which logs Wordfence IP blockings to make them available to other software such as Crowdsec.

Configuration

Options page is available in Tools admin menu.

options page

The only setting is about the log file rotation. You have 3 choices:

  • no rotation: nothing append, you can manage rotation with a tool like logrotage
  • day rotation: the log file will be renamed as "...-2024-08-03.log" when the file's modification date is older than the incoming event
  • size rotation: the log file will be renamed as "...20240803_154103" when it become bigger than the file size setting

Crowdsec side

You'll find in crowdsec/hub folder :

  • the parser crowdsec/hub/wordpress-wordfence-blockings-log.yaml
  • scenario crowdsec/hub/wordpress-wordfence-blockings-wsn.yaml to propagate Wordfence Security Network IP to Crowdsec, only those who have visited the website
  • scenario crowdsec/hub/wordpress-wordfence-blockings-san.yaml to propagate to Crowdsec IP who have exceeded a maximum requests per minutes

Thanks & Credits

Releases

2 releases.

Tag
Published
v1.0.1 latest
Aug 3, 2024 2 years ago
v1.0.0
Aug 2, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Wordfence blockings log 1.0.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.1
Findings
1
Worst severity
low
Content hash
bec84fe22f8a0400f0c9fcfe…

Findings

  • low Security event log stored at predictable public path

    information_disclosure

    LogFile writes every Wordfence security event ([date] [ip] [duration] [event] [reason]) to ABSPATH.'wp-content/logs/wordfence_security_event.log' with 0644 permissions and day-stamped rotated copies (wordfence_security_event-YYYY-MM-DD.log). No .htaccess/index guard is written, so on most hosts anyone can download visitor IPs and lockout reasons (which include attempted usernames), aiding user enumeration and leaking personal data.

    src/LogFile.php:8-53

    Recommendation

    Write outside the web root (configurable path), or add a deny-all .htaccess/index.php and random filename; also create the directory with 0755 instead of 0644.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →