Unable to create wordfence-waf.php | WordPress.org

Hi @cndz, thanks for providing your diagnostics.

The diagnostic indeed shows that auto_prepend_file isn’t active, but shows the appropriate permissions, wordfence-waf.php file location and other settings associated with Cloudflare, IPs, communication etc. also seem normal.

A typical wordfence-waf.php looks like this (WFWAF_LOG_PATH defined here can be changed to any writable location):

<?php
// Before removing this file, please verify the PHP ini setting <code>auto_prepend_file</code> does not point to this.
if( ! defined('WFWAF_STORAGE_ENGINE')) { define('WFWAF_STORAGE_ENGINE', 'mysqli'); }

if (file_exists(__DIR__ . '/wp-content/plugins/wordfence/waf/bootstrap.php')) {
	define("WFWAF_LOG_PATH", __DIR__ . '/wp-content/wflogs/');
	include_once __DIR__ . '/wp-content/plugins/wordfence/waf/bootstrap.php';
}

Also check that the .htaccess or .user.ini in the root of your site contains a line pointing to this file like:

auto_prepend_file="/your/path/to/wordfence-waf.php"

If manually populating the information above (with your own path substituted in) doesn’t result in the optimization showing as active, there may be another issue.

Thanks,
Peter.