Problem Description
Recently iThemes Security / Sucuri SiteCheck began returning 500 errors and Database errors when scanning sites on shared hosting.
iThemes relies on Sucuri’s external scanner for its malware scan, that scan reads the sitemap and then tries to access all pages of the site at once - typically all done within a second. If you’ve configured your site’s PHP FPM Settings to high limits (this option is only available to admin Plesk users with their own VPS) this may not be a problem, but typical sites will have their PHP process overwhelmed by the scan and may return 500 errors.
Since this is abnormal behaviour by a visitor, and iThemes reports it as “malware”, we consider this to be a false positive report.
Problem Resolution
One way of avoiding these false positives is to use a more reliable scanning tool such as WordFence which, when it does use external accesses, does so in a sane manner.
Even better would be to enable caching on your WordPress site by using a plugin like WP Rocket, WP Supercache, W3 Total Cache, or WP Fastest Cache. This generates static HTML files which the server will deliver as fast as needed and PHP will not need to run for each page load. It'll also make your site load faster, so it's a win-win!
