wfmark

Hi @danesthesia , thanks for reaching out.

Unfortunately, our 2FA and reCAPTCHA features are only supported for the default WordPress/WooCommerce login and registration pages and may not work on custom versions of these pages created manually or by other plugins/themes, which explains why you’re having trouble with this. 

We have plans to expand our compatibility in the future, although we cannot commit to timelines here on forums.

Thanks,

Mark.

Hi @arsah ,

Thanks for getting back.

It sounds like Wordfence is not detecting IP addresses correctly on your site. Take note of your IP  as displayed on https://www.whatsmyip.org. Please note that this detection can sometimes not be 100% accurate on cellular phone network connections.

Navigate to Wordfence > All Options > General Wordfence Options > How does Wordfence get IPs and reference the area under that section that says Detected IPs and Your IP with this setting. Start from the top and check to see if any of the settings show the same IP as the site above does.

Let me know how it goes.

Thanks,

Mark.

Hi @wpfanar ,

Thank you for getting back to us.

Typically, the Block IPs who send POST requests with blank User-Agent and Referer option is one we recommend keeping enabled. You can see our documentation on that here: https://www.wordfence.com/help/firewall/brute-force/#block-blank-post

Let us know if you’d like to look at the diagnostics to see if anything stands out going forward.

Thanks,

Mark

Hi @arsah , thanks for reaching out.

I tested IP-blocking on my end, and it is working as expected. Did you block the IP via the Wordfence > Firewall > Blocking > IP Address section?

If so, can you please confirm that you have blocked your public-facing IP address? It should be the same as the IP listed here – https://whatsmyip.com/ on the device you’re using to access the site.

If your IP address is blocked, you should see a Wordfence “Manual Block by Administrator” blocking page when you access the site.

You could also try clearing the cache on your browser or adding a cache-busting string to the end of the URL, such as /?no=cache, as you may be viewing a cached page.

Let me know how it goes.

Thanks,

Mark

Hi @joeyjosay , thank you for reaching out. 

To see the targeted file, please check Live Traffic at the same timestamp for additional information via Wordfence > Tools > Live Traffic > Show Advanced Filters > Filter > IP = (enter 209.38.200.253 in the IP field and click enter). The Live Traffic entries have more details about the block.

Another option is to check the raw access logs on the server for the IPs and hits around that time.

In most cases, a vulnerability in a specific plugin or version of WordPress isn’t tested in advance, and an attack will just hit a site, hoping something will work. Therefore, it’s best to stay up-to-date with WordPress & plugins and let Wordfence protect the site.

Increases in attacks and blocks can be alarming to see, however, in this case, there is no further action needed with Wordfence blocking the hits. 

Thanks,

Mark

Hi @perfectfit , thank you for reaching out.

With Wordfence activated, could you please request one of the users to attempt commenting on a post, then head over to Wordfence > Tools> Live Traffic (Expand All Results), if Wordfence is blocking this, there should be an entry that explains more about the traffic and why Wordfence took the actions it did. Please share a screenshot of any blocked entries and share it with me.

There’s also a possibility that this could be a false positive. Sometimes, plugins or themes may exhibit behaviour that resembles known attack patterns, resulting in the Wordfence Firewall blocking something that is not malicious. I suggest we try switching the Firewall to Learning mode, as it might help Wordfence allow comments on the post. 

From the Wordfence Dashboard, click on Manage WAF. Then, you will see  Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. Now proceed to post a comment. This will help Wordfence learn that these actions are normal and will allow them in the future. After you have finished the user registration, switch the WAF from Learning Mode back to Enabled and Protecting, then test to see that users can still comment.

https://www.wordfence.com/help/firewall/learning-mode/ is an amazing resource for learning more about the WAF and learning mode.

Thanks,

Mark.

You’re welcome, @voodoochill.

Are you always using the same device and browser when these issues occur or when the login is successful? If you’re using a different device or browser with different extensions, the low scores may be related to that.

Thanks,

Mark.

Hi @wpfanar, thanks for reaching out.

Wordfence runs the wordfence_syncAttackData script to ensure malware signatures and rules are up-to-date with the latest ones we have released and to update the Live Traffic page. Usually, 403 or 503 blocks by the firewall trigger the need to sync, so seeing syncAttackData triggered with one of these HTTP error codes is expected.

If you start seeing these requests excessively, your server’s IP address may be blocked. I recommend checking your Wordfence > Tools > Diagnostics page to see if you’re getting any errors under the Connectivity section> Connecting back to this site.

Let me know what you find.

Thanks,

Mark.