The firewall is using the database as a fallback

Vulnity Security persists part of the firewall state on disk and falls back to the WordPress database when the disk is not writable. This guide covers the warning shown while that fallback is active.

When to use this guide

Use this guide if WordPress shows a message such as:

• Right now we cannot write to /wp-content/uploads/vulnity-data, so the firewall is using the WordPress database as a fallback...

Or if the Vulnity panel shows the Firewall using database fallback warning for this site.

What it means

Vulnity persists part of the firewall state (block lists and the pairing backup) on disk, inside the uploads directory:

wp-content/uploads/vulnity-data/

If PHP loses write access to that folder, Vulnity automatically switches to storing that state in the WordPress database, so protection stays active. Nothing is lost: this warning is about performance and resilience, not about a security gap.

Note

This folder is not the same as wp-content/vulnity-data/ (the secure firewall/log storage covered by Cannot create the secure folder and The folder exists, but files cannot be written inside). This one lives inside uploads.

Vulnity repairs this automatically

You usually do not need to do anything:

• On every permission check, Vulnity tries to create the folder and lift its permissions.
• As soon as the folder is writable again, the data parked in the database is migrated back to disk. This is attempted on every heartbeat (about every 6 hours) and by a daily recovery task.
• Once migrated, the warning disappears on its own, and the warning badge in the Vulnity panel clears with the next heartbeat.

Follow the steps below only if the warning persists for more than a day.

Hosting-panel solution

1. Open your hosting file manager.
2. Navigate to your WordPress installation.
3. Open wp-content/uploads/.
4. Create the folder vulnity-data if it does not exist.
5. Set its permissions to 755. If that does not work, try 775.
6. Reload the WordPress panel and open Vulnity → Storage to re-check.

SSH solution

From the WordPress root:

mkdir -p wp-content/uploads/vulnity-data
chmod 755 wp-content/uploads/vulnity-data

If it still fails:

chmod 775 wp-content/uploads/vulnity-data

The owner should match the owner of wp-content/uploads/; it should not be root:

stat -c '%U %G %n' wp-content/uploads wp-content/uploads/vulnity-data
chown -R <user>:<group> wp-content/uploads/vulnity-data

If you prefer the database

The database fallback is also a supported permanent mode. Open the Vulnity → Storage screen in wp-admin and choose database fallback: the warning is then hidden on purpose, because it becomes a deliberate choice instead of a degradation.

Verification

Signs of success:

• The warning disappears from wp-admin and the badge clears in the Vulnity panel.
• Vulnity → Storage shows the disk as writable and no data pending in the database.

Message for hosting support

Message for support

PHP cannot write to wp-content/uploads/vulnity-data/. I need write permissions for the user or process running PHP on that folder (creating it first if it does not exist).

Next steps

• Storage screen of the plugin
• Cannot create the secure folder
• The folder exists, but files cannot be written inside