• Resolved marketingjflorido

    (@marketingjflorido)


    I just setup Wordfence and i’m getting alot of “failed login” attempts on the traffic log. These login attemps are with the admin usernames.

    I started manual IP Blocking, and manually permanently blocking these IP’s but here is the funny part: I got locked out of my own website, and i had to send the confirmation e-mail to unlock myself…

    I din’t do any failed login attempts, as my admin account logs in automatically. So what gives? I am 100% certain i only banned IP’s that had failed login attempts.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support wfmargaret

    (@wfmargaret)

    Hi @marketingjflorido,

    In Wordfence > Tools > Live Traffic, you can view details on any security events on the site.  To find which entry you may have used to block your own IP, you can check through the entries listed as coming from your IP.   You can find your IP by visiting https://www.whatismyipaddress.com and in the Live Traffic log, click the View icon next to any security events from your IP or Expand All Results at the top of the page to view details for any security events.

    If there are no security events from your IP in the Live Traffic log, there may be an issue with IP detection on the site.  To confirm whether IP detection is an issue, look up your public facing IP address at https://www.whatismyipaddress.com/ and visit Wordfence > Dashboard > Global Options > General Wordfence Options > How does Wordfence get IPs and cycle through the options. Your IP address should match the IP address shown on the line “Your IP with this setting“. Make sure to click SAVE CHANGES if you have to change this setting.

    Generally, we consider a manual blocking regime unnecessary as it can be time consuming to keep up with current URLs and IP ranges etc. Wordfence should protect you from known “bad” IPs, User-Agents etc. and now considers the intent of a human/bot by the pages they’re trying to visit (and how) the most important factor when blocking.

    If you want to have more control over the automatic blocks, I recommend reviewing the options at Wordfence > Firewall > All Firewall Options > Brute Force Protection.  Here, you can configure the login failure limit and how long the user is locked out.  If you’re the only user logging into the site, you can also enable Immediately lock out invalid usernames to immediately lock out someone who attempts to login with an invalid username.

    Thanks,
    Margaret

    Thread Starter marketingjflorido

    (@marketingjflorido)

    I had to change “How does Wordfence get IPs” to “Use the Cloudflare ‘CF-Connecting-IP’ HTTP header to get a visitor IP”. Since i’m using cloudflare, i guess i was manually blocking the IP for an entire Clouflare “datacenter” (?)
    Thanks ??

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘A Lot of Failed Login Attempts’ is closed to new replies.