If your WordPress website is showing a fatal error related to wordfence-waf.php, it means Wordfence Web Application Firewall (WAF) is misconfigured, missing, or corrupted.
Look at your WordPress error log or enable debugging in wp-config.php:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);
The log will be saved in:
wp-content/debug.log
Common errors related to wordfence-waf.php:
PHP Fatal error: require_once(/home/user/public_html/wordfence-waf.php): failed to open stream: No such file or directoryPHP Fatal error: require_once(): Failed opening required '/home/user/public_html/wordfence-waf.php'Manually recreate it.
wordfence-waf.php from /wordfence/public_html/).wp-config.php:
define("WFWAF_LOG_PATH", '/home/user/public_html/wp-content/wflogs/');Test if the issue is resolved.
If the error persists, disable Wordfence's firewall.
mv wordfence-waf.php wordfence-waf.php.bak
Find:
define("WFWAF_LOG_PATH", '/home/user/public_html/wp-content/wflogs/');
Replace with:
define('WFWAF_STORAGE_ENGINE', 'disabled');
This will disable Wordfence WAF but keep other protections active.
Ensure the correct permissions:
chmod 644 wordfence-waf.php
chmod -R 755 wp-content/wflogs
chown -R www-data:www-data wp-content/wflogs
Restart the web server:
sudo systemctl restart apache2
or
sudo systemctl restart nginx
If Wordfence is corrupted:
wp plugin deactivate wordfence
wp plugin delete wordfence
wp plugin install wordfence --activate
Now Wordfence WAF should work properly!
| Issue | Fix |
|---|---|
| Missing wordfence-waf.php | Restore it from a fresh Wordfence installation |
| Permissions error | Run chmod 644 wordfence-waf.php |
| Corrupted Wordfence | Reinstall with wp plugin install wordfence --activate |
| Want to disable WAF temporarily? | Rename wordfence-waf.php & edit wp-config.php |
Now your WordPress firewall should work smoothly!