FluentSMTP - WordFence Warning (False Positive)
If you use WordFence, you may get a warning about FluentSMTP like this. It's a false positive. The Monolog library is a part of Google's official package and is used by 100s of millions of PHP sites.
I wish WordFence would be more responsible about these warnings. Our team is now dealing with 100s of tickets. 🤦♂️
This is just to provide additional information: I just ran a Wordfence check on one of our websites (all of our sites are of course running FluentSMTP), and Wordfence didn’t report any issues with FluentSMTP.
This is also happening with WPMUDEV users of Defender Pro and WAF. I needed to disable one of the WAF Rule ID 213060. Waiting for the WPMUDEV support to get back to me
It makes me glad I'm not managing my protection as a plugin but instead with WAF rules.
William Beem Me too. I have Defender Pro set up to use WPMUDEV Web Application Firewall, that's where I disabled the WAF rule
William Beem just make sure you accept all incoming traffic on your VPS server only from CF IPs (network layer) otherwise it can be obmitted - CF WAF rules can be skipped by geeks.
Note: using just the WAF app layer (WP plugin only) might not be the best "protection" especially when the Admin account is attacked but this is just another cup of tea.
Mat There's no such thing as absolute security. It's a game of mitigating risks and that's never perfect. However, it's best to keep the invaders on the other side of the moat for most attacks. WAF rules do that.
William Beem I agree but if you wont have filtered incoming traffic (CF IPs only allowed) than thats easy to skip all CF (including CF WAF rules) 😇