webhostmg

Hi @wfphil, thanks for taking a look!

Totally get that Wordfence isn’t touching session cookies directly — that makes sense. What’s got us a bit stuck though is that we’ve tested this really carefully on our end, twice each way, and the pattern keeps repeating:

• Wordfence off → the logouts stop completely, both times we tried
• Wordfence back on → they come back, both times

Since it’s so consistent, we figured it’s worth flagging in case there’s something indirect going on — maybe something at the request level rather than the cookie itself? We wondered if it could be related to a background request getting delayed or blocked (like a heartbeat or admin-ajax call), especially since we’re behind Cloudflare and also run a staging copy of the site in a subdirectory (/staging/) that shows the exact same symptom on its own login.

No worries if it turns out to be something outside Wordfence entirely — we just wanted to share what we’re seeing in case it’s useful or rings a bell for you. Happy to send over a diagnostic export, server details, or hop on a screen-share if that’d help track it down. Really appreciate you looking into this for us!

Thanks so much,