Admin Login

  • Resolved CamZL1

    (@danishhaidri)


    3 years, 11 months ago

    Every time any user registers or logs in the website I am getting an ADMIN LOGIN ALERT email from WF?

    A user with username “danishhaidri” who has administrator access signed in to your WordPress site.
    User IP: 162.158.178.98
    User hostname: 162.158.178.98
    User location: Victoria, Australia

    A user with username “danishhaidri” who has administrator access signed in to your WordPress site.
    User IP: 163.172.219.158
    User hostname: 163-172-219-158.rev.poneytelecom.eu
    User location: Amsterdam, Netherlands

    A user with username “danishhaidri” who has administrator access signed in to your WordPress site.
    User IP: 141.101.69.216
    User hostname: 141.101.69.216
    User location: United States

    A user with username “danishhaidri” who has administrator access signed in to your WordPress site.
    User IP: 141.101.69.146
    User hostname: 141.101.69.146
    User location: United States

    This is all in the space of 7mins.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @danishhaidri, thanks for reaching out to us.

    It seems slightly unusual unless this user is using a VPN to attempt a sign-in from so many locations in a short space of time. If you are using a 3rd party external user management plugin, it may be using more user levels than the defaults in WordPress that are getting flagged as administrative accounts. This can also apply to any plugin with user registration capability such as WooCommerce.

    Naturally you can suppress these messages by unchecking Alert me when someone with administrator access signs in in Wordfence > All Options but this would also stop receiving alerts that may flag suspicious activity to you. Could I take a look at your site diagnostic if you send it to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    Note: For the fastest response time, please make sure and add any information or questions directly to this topic and not the email address above unless asked.

    Thanks,

    Peter.

    Thread Starter CamZL1

    (@danishhaidri)

    @wfpeter

    Thank you for your reply. I have sent the site diagnostics. What would you like me to send you on email?

    Please also note that we have just moved to AWS Bahrain last week and see all these issues which have never happened before.

    1. admin alters as mentioned in previous ticket
    2. all LIVE TRAFFIC IP addresses are incorrect

    Plugin Support wfpeter

    (@wfpeter)

    Hi @danishhaidri,

    This sounds from your new information potentially be an issue where your IPs are not being detected properly and is having an affect on all visitors.

    If you look up your public facing IP address at https://www.whatsmyip.org/ and visit Wordfence > Dashboard > Global Options > General Wordfence Options > How does Wordfence get IPs and cycle through the options, do any match your IP? Make sure to click SAVE if you do have to change this.

    You may find the “How does Wordfence get IPs” section informative on: https://www.wordfence.com/help/dashboard/options/#general-wordfence-options

    Let me know how you get on with that and whether you see any further blocks that don’t seem to tally with the correct IPs/locations in the mean time.

    Thanks,

    Peter.`

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Admin Login’ is closed to new replies.