Depending on your
wordfence => options => Firewall Rules,
after a few suspicious actions user is redurect to “Your access to this site has been limited” site where he can provide email to get ‘unlock email’.
If provided email is in db an user’s usermeta.user_level is higher than 7 user gets email with links to unlock (there is link to disable firewall too).
