Receiving Increased Attack Rate email notifications for site that does not exist

Hi @impactpixel, thanks for reaching out!

On site alerts, there is a link at the bottom of the email stating No longer an administrator for this site? Click here to stop receiving security alerts that should have the desired effect.

This has been put in place for a scenario where current site administrators aren’t responding, or can’t respond, to requests for your email address to be removed from the site. If the version of Wordfence is particularly out of date or you are unable to find this link in your email, the best course of action is setting a rule to direct these emails to another folder so that they don’t appear in your inbox.

If it’s a site you used to run but it’s now inactive, hosting for the site’s WordPress folder is still active somewhere and executing PHP. If that’s the case and you no longer have access to the account or server, I recommend contacting your previous hosts to tell them that you would like all data removed.

Many thanks,
Peter.

@wfpeter we are the original host and control the DNS for the subdomain – what is perplexing is there is no site on our server for this account nor is it in the WF Central therefore what is there to remove. What am I missing?

Hi @impactpixel, thanks for getting back to us.

The strange thing is that even if any part of Wordfence remained behind in the database, WP Crons or any other email would be triggered when the WordPress site is being hit, unless WP Cron was disabled and a manual scheduled task was set up to run the crons on the server.

We have seen some cases of staging/development sites still sending out alerts when the live site has gone so it would be worth seeing if any developers or servers still have an active copy of the site anywhere.

Our plugin removal process as highlighted in the following guide may be useful to you just to ensure everything has been considered:?https://www.wordfence.com/help/advanced/remove-or-reset/

Thanks again,
Peter.