Login Math question is not working

Thanks for the report! Could you walk me through the steps your site admins follow to skip the math verification, so I can try to reproduce?

Could you also post your site URL here, so I can take a closer look at your Protect settings? If you want it to remain private, you can also contact us via this contact form:
https://jetpack.com/contact-support/

Thanks!

I can’t give you the wp-admin URL, but I can give you the steps taken:

1. Log in the first time OK; no math question given.
2. Log out from wp-admin OK.
3. Log in again shortly afterward; math question asked.
4. Supply login name & password but skip math question.
5. Press ENTER or click SUBMIT; she gets into wp-admin area OK.

One admin is having this issue; the other answered the math question and got in fine, which is expected. It doesn’t appear to be specific to any one site within the multisite network, nor is it limited any one browser. We tested in FF & Chrome.

I looked at the Jetpack Protect settings. “Block suspicious-looking sign in activity” is turned on, both at network level and site level. We have no IP addresses in our whitelist. In other words, we’re using the default settings.

I hope that gives you enough to go on. I’m about to head to a conference, so won’t be back until Monday.

Thanks again!
Eddie

Thanks for the extra details!

Log in again shortly afterward; math question asked.

Does this happen after providing the wrong login details once, twice, or more?

I can’t give you the wp-admin URL

Could you send it to me via the contact form above, so I can take a closer look at the communication between your site and the Protect API?

Thanks!

They were logged in fine the first time. Then they logged out, and back in again very shortly afterward. I suspect the Protect plugin might’ve viewed this as brute-force attack behavior; hence the math question the second time. But that’s just my guess.

Do you *have* to log into our system to diagnose? I don’t mean to be difficult, but I’m really not at liberty to give that information outside our team.

Do you *have* to log into our system to diagnose? I don’t mean to be difficult, but I’m really not at liberty to give that information outside our team.

No, I don’t need any login credentials. I would just need to know your site URL so I can look at how the Protect API communicates with your site today, and if there are any issues with that communication.

I suspect the Protect plugin might’ve viewed this as brute-force attack behavior; hence the math question the second time. But that’s just my guess.

This is probably not the case, as the math fallback only appears if you fail to log in, if your IP has been flagged, or if your site fails to communicate with the Protect API.

I’m thinking it could be a communication issue, but I’d need to run some tests to find out.

Thanks!