Support » Plugin: Wordfence Security - Firewall & Malware Scan » wordfence_syncAttackData showing in live traffic

Viewing 9 replies - 1 through 9 (of 9 total)
  • BTW Deactivating maintenance mode made no difference.

    Also mention the CRON jobs for ?possibly? Wordfence are also showing in live traffic for first time as well.

    United States left and visited

    Plugin Support wfphil



    The “/?wordfence_syncAttackData=” that you see in the URL’s in your “Live Traffic” feed is used to update the Wordfence “Live Traffic” page with information.

    I have taken this back to the team to look at to see why this might be happening.

    It is interesting that you see a blank page when you visit the URL. If you had seen your home page or a 404 page not found instead then that would have indicated a theme or plugin conflict.

    Also, you may be blocking legitimate visitors by adding the manual blocks if you wish to review the blocks that you have put in place.

    Had this (wordfence_syncAttackDat) pop up in my Pingdom report as I was researching why my website was lagging severely over the past week. Went into Live Traffic and saw Wordfence was blocking my host’s IP address all of a sudden. So if you see blocked for Manual block by administrator, you may want to check and make sure it’s not your host’s IP address.

    Plugin Support wfphil



    You can see “/?wordfence_syncAttackData=” in your URL’s if you have placed a block on your hosting server IP address.

    You can ask your hosting provider what your server IP address is and then use the Live Traffic Advanced Filters and search by that IP address. If the results show that you have blocked your server IP then you will need to unblock it.

    Thank you.

    Plugin Support wfchloe



    I hope we were successful in helping you resolve your issue with Wordfence! Since we have not heard back from you in the past 2 weeks I will now be marking this support thread as resolved. However, if we still haven’t resolved your issue please reach out to us as we would be more than happy to further assist you!

    Thanks and have a great day!


    I haven’t blocked my server IP address. This issue has suddenly appeared coincidentally? after a Wordfence update.

    I have since whitelisted the IP address of the server (which was a challenge to confirm) in the Wordfence settings which has removed /?wordfence_syncAttackData issues from live blocking.

    BUT the CRON entries were still showing.

    This issue has since gone away with recent plugin updates. So either voodoo or a bug you have now fixed.

    Plugin Support wfphil



    If whitelisting your server IP stopped “/?wordfence_syncAttackData=” showing in your “Live Traffic” feed then it does look like you are blocking your server IP somewhere in Wordfence.

    If you are seeing “?doing_wp_cron=” in your Live Traffic feed though this may indicate that you are still blocking your server IP. Can you take a screenshot of one of these hits with “?doing_wp_cron=” in the URL. Please send to phil [@] wordfence [.] com

    I will also need to know your domain name and also put your user name plus this forum thread URL in the email so that I know that it is from you.

    Thank you.



    Thanks @wfphil when this reappears I will do as asked.

    Currently it isn’t showing this in Live Traffic anymore.

    Something I wasn’t aware of at the time of this issue was a hosting environment change. Provider has recently implemented an AI detection system to bounce hacking and DOS attempts using behaviours etc

    Read more here

    I don’t know if this influenced the issue. FYI anyhow.

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘wordfence_syncAttackData showing in live traffic’ is closed to new replies.