“Unlock email requested” bypassing SMTP settings?

Hi @arcstone, thanks for getting in touch.

This looks the same as an issue we looked into with WP Mail SMTP plugin a couple of years ago, which has a little more technical information.

In a nutshell, we send lockout emails (in particular) very early in the site loading process compared to the other emails that are being logged. We can’t change this as Wordfence needs to block visitors that could cause a security issue without allowing more code from WordPress and other plugins to run.

I’m not sure if the other customer tried to contact the WP Mail SMTP developers to see whether they were able to set their hooks any earlier, but it could be worth a try.

Thanks,
Peter.

Thanks for the reply and background. Is there any way to customize that particular email in Wordfence? It’s sending with a spoofed email “wordpress@<customerdomain.com>”. That doesn’t exist, and is nowhere to be found in the WP database.

Hi @arcstone,

Our mailings will send from wordpress @ domain . com, which is the default in WordPress and cannot be reconfigured through Wordfence.

The best way we know to change the “From” address is by adding a mu-plugin, by creating a file at?wp-content/mu-plugins?with contents like:

<?php add_filter('wp_mail_from', function() { return '[email protected]'; } );

The filename isn’t important, but I’d use something like?wp_mail_from.php, since it makes the purpose of the file clear. It will still go through your host’s mail server for any mail sent before the SMTP plugin is ready, but if it’s an address that the host allows, that may be a good solution for you.

Thanks again,
Peter.

Thanks for the tip, that’ll definitely help.