sgpark

Same here.

I’m also having problems with this. I don’t want to display any retweeted tweets, whether from my account or @ my account or # my account. There appears to be no option for this. Also, in my settings for displaying tweets from my account, when I uncheck “show retweets” it still shows retweets.

I can and have hacked the plugin code myself in the past, but just making sure I’m not missing some way of doing it without altering your code.

The Wordfence developers are smart guys who appreciate the needs of end users and also have a clear understanding on what hackers do and how they do it. When it comes to this point I think they are way smarter about it than either of us. In other words, give the Wordfence developers credit for listening to user’s ideas and being able to discern their worthiness. They are not going to respond to any form of bullying.

If you think asking for a feature and explaining why is “bullying”, then I don’t know what to tell you.

If anything, trying to imply that anyone asking for the feature is ignorant and lazy, as you do, is closer to “bullying” than making a request for a feature.

We’re all trying to contribute to a better experience for the WordPress community. I’m not sure why you’re so insistent that people asking for this feature are in the wrong. A polite disagreement is great, but that’s not what you’ve offered here. You’ve instead tried to second guess everyone else and assume that the people asking for this feature have not thought about it at all.

As I said before, WordFence is a great plugin and service, and I have nothing but good things to say about it. I merely think that people asking for the feature in question are asking for something that, if possible, would be a very useful improvement to an already good plugin.

Are you saying that content writers have admin rights? Anyone with admin rights should be aware of any restrictions from typing an incorrect username/password combination.

No, I’m saying that content writers would be affected exactly the same way as admins–they would be locked out if they mistyped if the WordFence “Immediately lock out invalid usernames” option is checked.

At the risk of sounding ‘hostile’ why don’t you back off the “one attempt and you’re locked out” mentality? Be kinder, gentler and give them at least three attempts to login before locking them out. It is a fair compromise from the all or nothing stance.

Why? Because this:

If you examine the Wordfence logs you’ll discover that nearly all of the hack login attempts are from bots.

You’ve answered your own question.

And you assume I don’t already have a forgiving lock-down setup for bad typists. I do. But there’s a reason why WordFence provides both options–to block invalid usernames and to allow only a certain number of bad logins–and there’s a reason why WordFence allows them to work simultaneously: because they address different aspects of the problem. We’re merely pointing out ways for the “lock out invalid usernames” functionality to be more useful to many people who run WordPress sites.

At first they use ‘admin’, but over time they try different user names–most of which are variations of poster’s names.

I’ve probably managed over 30 WordPress sites in my time and currently manage 8 active ones, all with WordFence installed, and I’ve never seen this. The ones that get blocked for excessive login tries are always using “admin” or “administrator”. Once, someone tried “guest”.

Instead of sounding like a defensive WordFence developer, maybe you should try to understand why the people asking for this functionality want it. That’s all I’m saying. Maybe some have already tried all the alternative approaches you think we haven’t bothered to consider, yet we still think it would improve WordFence to add the ability to immediately block specific usernames–especially “admin” and “administrator”–instead of a catch-all “lock out invalid usernames”.

There is already such a method. Wordfence–>Options–>Login Security Options–>Immediately lock out invalid usernames. Since you’ve removed the user Admin anyone attempting to use it would immediately be locked out.

As people have already mentioned, this option locks out valid users who mistype their logins. That’s an unacceptable hit to usability. Sure, it’s not permanent, but it’s still a real problem. What if an admin has to make an urgent update and mistypes her username?

I would also like to request the ability to manually enter a list of usernames that are automatically locked out. This would help with attacks on “admin” and also help with securing sites against disgruntled former users that may have been banned, etc.