If your host blocks login attempts before they reach the site, that may happen, but it’s usually unlikely that every one of them would be blocked. Aside from the plugins you mentioned that you don’t have, from other people’s posts — do you have any different security plugins, or other plugins that affect the login process, such as a captcha?
If not, it may be a database problem. Near the bottom of the Wordfence Options page, can you click the link that says, “Click to see a list of your system’s database tables in a new window”?
It will show a lot of information, but if you can copy and paste the line that begins with “Name: wp_wfBlockedIPLog”, that may be helpful. (It could wrap to 2 or 3 lines, depending on your browser.)
If you are familiar with phpMyAdmin, or any other tool your host uses for managing your database, you could check if the wp_wfBlockedIPLog table is damaged, and repair it if necessary. If you don’t normally work on the database like this, you may want to see if your host can check the table for you.
Alternately, if none of this helps, removing and reinstalling Wordfence would recreate the table, which could help if it is a database problem:
How to reinstall Wordfence completely
(Note that this would remove all of your Wordfence settings and any permanently blocked IPs as well.)
-Matt R
Here is the record from the database:
Name: wp_wfBlockedIPLog Engine: MyISAM Version: 10 Row_format: Dynamic Rows: 0 Avg_row_length: 0 Data_length: 0 Max_data_length: 281474976710655 Index_length: 1024 Data_free: 0 Auto_increment: Create_time: 2015-10-26 09:58:17 Update_time: 2015-10-26 09:58:17 Check_time: Collation: utf8_general_ci Checksum: Create_options: Comment:
Doesn’t look like there’s much to it. I just installed the plugin a few days ago, so I don’t mind reinstalling, but just wondering why this may be happening.
In phpmyadmin, all the tables are there, there is nothing in the wp_wfBlockedIPLog table. There is data in some of them, and in the wp_WFStatus table I can see records for a scan up to 1000 files, but then it just stops.
I will try removing the plugin and reinstalling.
Ok, the information about the wfBlockedIPLog table looks normal, aside from being empty. Since you did just install the plugin a few days ago, it’s possible that there were no blocked login attempts yet.
Some sites will get bad login attempts daily, but others seem to get them in bursts. (It depends on which bad bots have found your site.) If your host does anything to protect the site or the login url too, it can decrease the number of bad attempts that reach WordPress.
Just to be sure, if you whitelisted any IP ranges in the “Whitelisted IP addresses that bypass all rules” field, you can also check that the ranges aren’t too broad. Also, if you view the Live Traffic page on the Wordfence menu, you can check that the IP address shown for your own logins on the “Logins and Logouts” tab is your own IP — some server setups will not show the true IP, but there is an option to set if that is the case.
The wfStatus table is ok if it’s only 1000 records — it stores the most recent scan log entries, but it is trimmed daily, so that it doesn’t grow too large over time.
-Matt R
I uninstalled and reinstalled the plugin, and it started working correctly after a day or two. Maybe the installation glitched the first time or something. Or, like you said, maybe it just took a while longer to start collecting data. It was about a week, and I’ve never had a site take that long for hackers to find it. Thanks for checking the table to make sure everything looked normal there. We’ve had a few sites hacked this week, so it helps to know that the security is working as it should!
Ok, great — thanks for following up!
-Matt R
