wfmark

Hi @wpmakenorg, Thank you for reaching out.

Do you see any pop ups to accept Wordfence Terms and Conditions? Can you please send a screenshot of the dashboard notifications?

You can use Snipboard  https://snipboard.io/ to send us a screenshot.

Thanks,

Mark

Hi @sinapars, Apologies for the delayed response.

Could you please  send a diagnostic report to wftest@wordfence.com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

Thanks,

Mark.

You’re welcome @stevebrett.

Let me know if you need any further assistance.

Thanks,

Mark.

Hi @psypat,

Apologies for the delayed response.

It looks like the redirects happen before Wordfence blocks the URL.

So when the user is redirected to https://banned.se, the block won’t take effect.

Thanks,
Mark.

Hi @kwisatz, Thank you for reaching out.

Are these login attempts being blocked by Wordfence?

When logged in to the site, could you please navigate to Wordfence> Tools> Live Traffic and confirm whether you see any Traffic entries of the blocked login attempts on this page?

Brute force login attacks are one of the most common attacks that we see and are normal. We see millions of brute force login attempts per hour on WordPress sites protected with Wordfence.

Wordfence does all of the important blocking for you automatically so you don’t have to, but if you wish to make your brute force or rate limiting rules a little stricter so that they can’t retry as frequently, for example reducing login failures to 3 or 5 instead of 20, you might find the following links useful:

https://www.wordfence.com/help/firewall/brute-force/ 

https://www.wordfence.com/help/firewall/rate-limiting/ 

If there are successful login attempts and the user has administrative access, please let me know.

Thanks,

Mark.

Hi @michael2010, thank you for reaching out.

Have you tried starting scans remotely from the Wordfence > Tools > Diagnostics > Debugging Options section? Does the exact same issue occur? There are other scan troubleshooting tips here: https://www.wordfence.com/help/scan/troubleshooting/

If nothing that I’ve suggested there works and you’re on Cloudflare or Litespeed, there can be other configuration requirements to prevent scans from stopping but the best way for me to determine this would be getting a scan log and diagnostic report from you.

If you could do the following steps for me:

• Go to the Wordfence > Tools > Diagnostics page
• In the “Debugging Options” section check the circle “Enable debugging mode”
• Click to “Save Changes”.
• CANCEL any current scan and start a NEW scan
• Copy the last 20 lines from the Log (click the “Show Log” link) or so of the activity log once the scan finishes and paste them in this post.

Wordfence > Tools > Diagnostic > Debugging Screenshot

This will help me see exactly what is happening when the scan fails.

Then, can you send a diagnostic report to wftest@wordfence.com? You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,

Mark.

Hi @stevebrett, Thank you for reaching out.

Wordfence has three rules that check for unsanitized files containing malicious code that can be uploaded to and executed by the web server. The rules are  “Malicious File Upload“, “Malicious File Upload (PHP)“, or “Malicious File Upload (Patterns)” and can be found in Wordfence > All Options > Firewall Options > Advanced Firewall Options > Rules after expanding the list.

There have been occasions when customers needed to disable one of these to prevent false positives. There are layers to how uploaded files are checked, so having to turn one of these rules off to fix any issues should still ensure malicious files are caught at a different stage of the checking process. Disabling/enabling them one by one can reveal exactly which one(s) can be permanently turned off to prevent any upload issues from reoccurring for your users.

I hope this is helpful.

Thanks,

Mark.