Why does the alert say 10800 seconds?

Because 10,800 seconds is three hours, the current default limit Wordfence documents for one scan. The number is not a PHP error code or an attack signature; it is simply the configured maximum runtime expressed in seconds. A custom value in Scan Options can make the message show a different number.

Can I fix it by setting the Wordfence scan limit to unlimited?

Sometimes, but start by reducing unnecessary work. Backup archives, another application below the same web root, or scanning images as executable can turn a normal scan into hours of file reads. A host may also kill the process at its own CPU or memory limit, so an unlimited Wordfence setting cannot overrule the hosting platform.

Will Wordfence resume the timed-out scan where it stopped?

No. Wordfence documents that a scan which runs out of time does not automatically resume; the next scheduled scan makes a fresh attempt. That means a persistent limit can leave the same late stages unchecked every run. After changing the cause, confirm one scan reaches its completed state before trusting a clean result.

Glossary · Scan health

Scan time limit of 10800 seconds exceeded

Wordfence type: timelimit
Category: Scan health
Severity: Operational — incomplete coverage

Wordfence stopped before the scan finished because it reached the default three-hour, or 10,800-second, scan limit.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

Scan terminated with error: The scan time limit of 10800 seconds has been exceeded.

What Wordfence found

Wordfence limits how long one scan can run. Its current default is three hours, which the alert writes as 10,800 seconds. When that limit is reached the scan stops and does not resume from the same point; the next scheduled scan starts another attempt.

Why it matters

This is not evidence of an intrusion, but it invalidates the comforting interpretation of a quiet scan. Anything in the stages Wordfence had not reached was not checked, and a site that hits the same limit on every run can repeat the same blind spot indefinitely.

How to fix it

1Open Wordfence > Scan > Scan Options and Scheduling and confirm the configured time limit before changing it.
2Reduce unnecessary scope first: disable scanning files outside the WordPress installation if it includes backups, media archives or another application, and exclude large non-executable backup directories.
3Run scans during a quieter period or enable low-resource scanning if the host is killing heavy work, understanding that low-resource mode takes longer.
4Increase the scan time limit only when the host has enough CPU and memory for a longer run; shared hosts may enforce their own limit regardless of Wordfence's setting.
5Run another scan and confirm that it reaches completion before treating its findings as full coverage.

Common questions

Why does the alert say 10800 seconds?: Because 10,800 seconds is three hours, the current default limit Wordfence documents for one scan. The number is not a PHP error code or an attack signature; it is simply the configured maximum runtime expressed in seconds. A custom value in Scan Options can make the message show a different number.
Can I fix it by setting the Wordfence scan limit to unlimited?: Sometimes, but start by reducing unnecessary work. Backup archives, another application below the same web root, or scanning images as executable can turn a normal scan into hours of file reads. A host may also kill the process at its own CPU or memory limit, so an unlimited Wordfence setting cannot overrule the hosting platform.
Will Wordfence resume the timed-out scan where it stopped?: No. Wordfence documents that a scan which runs out of time does not automatically resume; the next scheduled scan makes a fresh attempt. That means a persistent limit can leave the same late stages unchecked every run. After changing the cause, confirm one scan reaches its completed state before trusting a clean result.

Findings that often appear with this one

Other incomplete scan status messages Scan health
Wordfence reports low disk space Scan health

How WPSecureOps treats it

The connector reports this as timelimit. WPSecureOps files it under Scan health and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.