Wordfence Blocking Academy LMS Dashboard

Hi @tuham,

Thank you for reaching out. If Wordfence was interfering with the request to the page, I would expect a 403 or 503 along with a Wordfence-branded block page. It’s certainly interesting that 404s are being seen when Wordfence is enabled, so another request may be getting blocked in the background or there’s a plugin conflict of some kind.

View your Live Traffic immediately after requesting the page to see if a block is being picked up there. If so, you should be able to see which rule is causing the block by clicking that line (or “eye” icon) to expand it. Sometimes you are presented with a “ADD PARAM TO FIREWALL ALLOWLIST” button here that could solve any problems going forward.

Learning Mode, while logged in as an admin, should help if the 404s are being caused by blocks in the background of your site. You can turn this back on any time for testing from the Wordfence Dashboard, by clicking on Manage WAF. Then you will see Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. Now perform or trigger the actions in the instructor dashboard that have been having problems. This will help Wordfence learn that the communications taking place at this time are normal and will allow them in the future. After you have finished testing, make sure to switch the WAF from Learning Mode back to Enabled and Protecting.

Let me know how it goes!

Thanks,
Margaret

Hi @tuham,

Thanks for following up!

Please temporarily switch your Wordfence > Tools > Live Traffic logging mode in Live Traffic Options to ALL TRAFFIC. This will cause the Live Traffic log to track any 404 errors.

Then, revisit the Academy LMS dashboard. Please expand any new 404 entries in the Live Traffic log by clicking on them, and send me a screenshot either here or to our email wftest @ wordfence . com. If you email the screenshot, please include your forum username in the subject, and let me know here once you’ve sent it.

Thanks,
Margaret

Hi @tuham,

You mentioned that you are able to access the instructor dashboard normally when Learning Mode was enabled. Please enable Learning Mode, and keep an eye on Allowlist URLs in Wordfence > Firewall > Manage WAF while using the instructor dashboard. Please send a screenshot of any new entries added to the list either here or to our email wftest @ wordfence . com. If you email the screenshot, please include your forum username in the subject.

It might help to see your diagnostics. Can you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

If possible, I’d also like a copy of access logs during a period where you received the 404 errors in the dashboard. Your host should be able to provide you with a copy of your access logs. Please send those to the same email.

Thank you,
Margaret

Hi @tuham,

Thank you for the additional clarification! I’m going to ask a few questions for additional context.

1. The initial All Courses page loads, showing a list of all courses. Once you click on a specific course you’re presented with the 404 pop-up. Is that correct?
2. Does the 404 error pop up when trying to open every course, or only specific ones?
3. When the firewall is set to Learning Mode, does anything change?
4. When the firewall is set to Disabled and Wordfence is still activated, does anything change?

Please make sure to set the firewall back to Enabled and Protecting after testing.

Can you please send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

If possible, I’d also like a copy of your access logs from the period when you received the 404 errors. Your host should be able to provide you with a copy. Please send those to the same email.

Thanks,
Margaret

Hi @tuham,

Thank you for the additional information. I have tested the plugin but I haven’t been able to replicate the 404 error you see. I tested on a clean copy of WordPress with Wordfence installed and I created one test course. If there are any steps I can take to replicate the issue, please let me know and I’ll be happy to test those.

If you have access to a staging site, please test if the Courses page loads normally with only Wordfence and Academy LMS active and with a default theme such as Twenty Twenty-Five active. If it does, please try activating additional plugins and the normal theme one by one to find the source of the conflict.

If that doesn’t help, there are also two settings adjustments I’d like you to try. Please go to Wordfence > All Options > Brute Force Protection > Additional Options and deactivate the option “Prevent discovery of usernames through ‘/?author=N’ scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps.” Then, check the Courses page again.

Please go to Wordfence > All Options > Allowlisted URLs and deactivate both options in “Monitor background requests from an administrator’s web browser for false positives.” Then check the Courses page once more.

Let me know how it goes!

Thanks,
Margaret