Hi Marcus,
Correct, it does log failed logins and it works for sure, as we have tested it properly.
Do you have some plugin that hooks to the WordPress login page by any chance?
Further investigation shows that the “Better WP Security” plugin intercepts and replaces the wp_authenticate method. If BWPS has the “Login limits” option turned on (to protect against brute force attacks), then it doesn’t fire the wp_login_failed action, instead sending it only to its own log (bwps_secure->logevent).
So as far as I’m concerned this is a bug in Better WP Security, not in WP Security Audit Log at all.
(marking as resolved since it’s the fault lies elsewhere)
Hi Marcus,
Thanks for looking into this issue yourself and for pointing out what the problem is.
I agree with you, that this is an issue from Better WP Security.
Thanks and have a great day.
