wfmark

Hi @paulproe, Thanks for reaching out.

Unfortunately, our 2FA and ReCAPTCHA features currently only work for the default WordPress and WooCommerce login and registration pages and may not work on custom login and registration pages generated by other plugins or themes.

We have plans to expand our compatibility in the future, although we cannot commit to timelines here on forums.

Thanks, 

Mark

Hi @anafasia,

Thank you for sending the debug log.

To send the diagnostic report, please try the below instead:

Navigate to Wordfence > Tools > Diagnostic page and then click the “Export” button. Send the txt file to wftest@wordfence.com. Add your forum username in the subject and respond here once done.

Thanks,

Mark.

Hi @alamana , thanks for reaching out.

Can you please confirm the location of the modified files? Depending on the location of the modified files, head over to Wordfence>All Options>Scan Options>General Options and scroll down to confirm that these three options are enabled: 

• Scan core files against repository versions for changes
• Scan theme files against repository versions for changes 
• Scan plugin files against repository versions for changes

Additionally, make sure you have not included the directories that contain the modified files in the List of directories to exclude from the recently modified file list option under Wordfence>All Options>Activity Report.

Please note that the Recently Modified Files section in the Activity report only includes a maximum of the 10 recently modified files at the time the report is sent.

Let me know how it goes.

Thanks,

Mark. 

Hi @acurran , thanks for reaching out.

Please check and make sure that you have not blocked access to the “wp-admin” directory with a “.htaccess” file or limited access to it via another method. If you have, make sure to allow your server’s IP address to access this directory. Also, check if you have Memcache running on your server. Memcache may have to be restarted twice in order for the object cache to remove the saved Wordfence scan cronkey.

If you have already tried the troubleshooting steps above, please send a diagnostic report to wftest@wordfence.com. You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

Let me know if this helps.

Thanks

Mark. 

Hi @alexliii , thanks for getting back to us and sorry for the late response.

As a workaround, you can enable the “Allow remembering device for 30 days” option so users don’t need to use 2FA every time when they use the same browser to sign in under Wordfence> Login Security> Settings or add the administrator IP addresses under “Allowlisted IP addresses that bypass 2FA and reCAPTCHA”.

I hope this helps.

Thanks,

Mark

Hi @thedetoureffect , thanks for getting back to us.

With Wordfence enabled, please attempt a sign up then head over to Wordfence > Tools> Live Traffic (Expand All Results) and share with us a screenshot of any live traffic entries of the failed sign ups. If there’s nothing there, it may require the Traffic Logging Mode to be changed temporarily to ALL TRAFFIC, and re-attempting the sign up to log it.

Remember to obscure the IP address and hostname on the screenshot you send us.

Thanks,

Mark

Hi @jstepak , thanks for reaching out.

Can you please confirm the IP address these attacks are coming from? We have previously seen this when hosts modify core files which is common for most hosting providers.

For context, these blocks are triggered by hitting example[.]com/wp-admin/install.php, which in return generates the blocked by firewall for WordPress New Install File Probing.

These types of attacks are explained in detail here: https://www.wordfence.com/blog/2017/07/wpsetup-attack/ 

Please note we do not recommend blocking IPs permanently, as Wordfence is already blocking them, and attackers rarely reuse IP addresses. For more information on blocking, please check out the resources below:

https://www.wordfence.com/help/blocking/#ip-address 

https://www.wordfence.com/blog/2017/11/should-permantly-block-ips/

Let me know in case you have any further questions.

Thanks,

Mark.

Hi @binaryfabric , thanks for reaching out and sorry for the late response.

Can you please confirm the “reCAPTCHA human/bot threshold score” you have set in Wordfence > Login Security > Settings?  The threshold is set to 0.5 by default. A lower threshold setting like 0.3 might allow bots too often, while setting it higher like 0.6 or 0.7 might block them out. Note that sometimes valid users might be blocked out when the threshold is high.  

General treatment of bots can also be set in the Rate Limiting section of  Wordfence > All Options to limit how many pages visitors and automated crawlers can access your website per minute as described in this article https://www.wordfence.com/help/firewall/rate-limiting/ 

I would recommend setting Rate Limiting Rules to these values to start with:

Rate Limiting Screenshot

It is also worth mentioning that our 2FA and reCAPTCHA features are only supported for the default WordPress/WooCommerce login and registration pages and may not work on custom versions of these pages created manually or by other plugins/themes, that is in case you are using a custom login page. 

Thanks,

Mark.