.user.ini points auto_prepend_file to a missing file: HTTP 500 after a move
What the site owner saw
After the site was moved to another host, every page including the login page returned HTTP 500. The host error log showed "PHP Fatal error: Failed opening required '.../wordfence-waf.php'". A plain file (/license.txt) still returned 200.
Source (public forum thread): https://wordpress.org/support/?p=17075291
Test setup and what we observed after the failure
Test site: WordPress 7.1, PHP 8.3. The table shows the HTTP status of the homepage and the login page after the recipe recreated the failure.
| Server setup | Homepage | Login page | Note |
|---|---|---|---|
| Apache + PHP-FPM | 500 | — | /license.txt returned 200. The login page status was not recorded in these runs. |
Outcome of each run
| Date (UTC) | Server setup | Connection mode | Outcome | Product version | Note |
|---|---|---|---|---|---|
| 2026-11-06 | Apache + PHP-FPM | SSH | Not recovered | 2.1.434 | The re-check did not pass, and the system issued the automatic recovery-fee refund (payment is simulated in the lab). |
| 2026-11-06 | Apache + PHP-FPM | SSH | Declined at the pre-payment check | 2.1.434 | The pre-payment check timed out. |
| 2026-11-06 | Apache + PHP-FPM | SSH | Recovered | 2.1.435 | |
| 2026-11-06 | Apache + PHP-FPM | FTP | Case did not complete | 2.1.434 | Copying the site over FTP stalled and the case did not reach the health check. |
| 2026-11-06 | Apache + PHP-FPM | FTP | Declined at the pre-payment check | 2.1.434 | The pre-payment check timed out. |
| 2026-11-06 | Apache + PHP-FPM | FTP | Recovered | 2.1.435 | The FTP server offered explicit TLS and the product used it. |
Gaps and the version that fixed them
Every run that did not end in "recovered" is listed here: what we changed, the version it shipped in, and the re-test date and outcome.
| Found | Server setup | Connection mode | What we changed | Fixed in | Re-test |
|---|---|---|---|---|---|
| 2026-11-06 | Apache + PHP-FPM | SSH | The recovery removed the broken setting on the copy, but the copy's PHP kept the old setting cached and the re-check failed. The copy now reloads PHP after the change. | 2.1.435 | 2026-11-06 · Recovered |
| 2026-11-06 | Apache + PHP-FPM | SSH | The pre-payment check timed out on this setup; it no longer does. | 2.1.435 | 2026-11-06 · Recovered |
| 2026-11-06 | Apache + PHP-FPM | FTP | Copying the site over FTP stalled and the case did not reach the health check. The copy step no longer stalls on this setup. | 2.1.435 | 2026-11-06 · Recovered |
| 2026-11-06 | Apache + PHP-FPM | FTP | Over plain FTP, passive-mode replies were dropped between the recovery station and the test server, and the pre-payment check timed out. The product now uses explicit TLS when the server offers it. The re-test was run after the test server was set to offer TLS; plain FTP on this path has not been re | In progress | — |
Problem types this case covers
Notes
On this setup PHP-FPM re-reads .user.ini on a cache interval, so a change to that file takes effect after a delay rather than on the next request.
These are records from our test servers, for a given product version on a given day. They are not a promise about the result on any site. Other hosts, PHP versions, and WordPress versions can behave differently.