Symptoms
- Plesk Obsidian running on a Linux-based operating system
- A WordPress website (example.com) that uses the Wordfence plugin shows a 500 external Server Error once opened in a browser
-
Error messages that are similar to the following can be found in the
/var/www/vhosts/system/example.com/logs/error_logfile:2024-06-05 11:25:34 Warning 203.0.113.2 AH01071: Got error 'PHP message: PHP Warning: Unknown: open_basedir restriction in effect. File(/var/www/vhosts/example.org/httpdocs/wordfence-waf.php) is not within the allowed path(s): (/var/www/vhosts/example.com/:/tmp/) in Unknown on line 0; PHP message: PHP Warning: Unknown: Failed to open stream: Operation not permitted in Unknown on line 0; PHP message: PHP Fatal error: Failed opening required '/var/www/vhosts/example.org/httpdocs/wordfence-waf.php' (include_path='.:/opt/plesk/php/8.2/share/pear') in Unknown on line 0' Apache error
2024-06-05 11:55:28 Error 203.0.113.2 500 GET / HTTP/1.0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 745 Apache SSL/TLS access - A file called
.user.inithat resides within the Document root directory of the website contains lines that are similar to the following:; Wordfence WAF
auto_prepend_file = '/var/www/vhosts/example.org/httpdocs/wordfence-waf.php'
; END Wordfence WAF
Cause
The domain example.com tries to get access to a Wordfence-related file in the folder of another domain (example.org), which is not allowed, because different Subscriptions in Plesk are isolated intentionally.
Resolution
1. Log into Plesk
2. Go to Domains > example.com > Dashboard > Files
3. Either rename the file .user.ini to .user.ini-bak and save the changes (in order to disable this file) or edit its contents, so that the used path becomes /var/www/vhosts/example.com/httpdocs/wordfence-waf.php instead of /var/www/vhosts/example.org/httpdocs/wordfence-waf.php