Wordfence clashing with step 2 verification

Also just to add the 1 out of the 3 sites that does work ok has the following ticked on my profile page.
Enable AMP developer tools to surface validation errors when editing posts and viewing the site.(This presumes you have some experience coding with HTML, CSS, JS, and PHP.)

Hi @andye20, thanks for getting in touch.

Wordfence 2FA only works with the default WordPress login form, so if you have an alternative path specified, or a 3rd party login page such as WooCommerce this may affect why 2FA isn’t working.

Also, plugin conflicts can occur so if you are using the default login page, try disabling all plugins except for Wordfence and see if 2FA logins start working. Re-enabling them one-by-one will help you find which one is conflicting. This may also be accompanied by browser console errors when you visit the login page, that you could screenshot using a service like Snipboard to help us see what’s happening.

For your reference, if 2FA stops you from logging in, you can disable Wordfence yourself by look inside the /wp-content/plugins/ directory and renaming the wordfence directory to wordfence.bak. Logging in and then renaming the folder back to “wordfence” will let you configure the plugin again.

Let me know how you get on!

Thanks,

Peter.

Hi Peter thanks for your reply the thing is why did the Wordfence plugin clash with me activating 2FA on 2 of my sites.
I could not get past the initial log in and my host company kindly got me access by saying they had to disable the wordfence plugin on 2 of my 3 sites.
Now I have initial log on but no 2FA or Wordfence.

Hi @andye20,

The 2FA may have been affected on 2 sites if you’re using a common set of plugins, the theme is the same, or one is a clone of the other so shares many of the same characteristics. I would consider plugins and themes first. Try only having a default theme such as Twenty Twenty-One and Wordfence as the only enabled plugin. If 2FA works under those conditions, we’re looking at a theme or plugin conflict. Re-enabling your theme first and re-testing followed by one plugin at a time will help you narrow down the cause.

The 2FA is likely disabled now after the host performed similar actions to the Wordfence plugin folder rename I described, although if Wordfence is entirely missing it may have either not been named back to ‘wordfence’ in your /wp-content/plugins folder or deleted entirely and needs to be reinstalled.

Let me know how your testing goes.

Peter.

Hi Pater thanks for getting back to me.
No my host never renamed the wordfence folder I have Plesk control panel so can disable or active it without logging on to site dashboard.
The 3 sites are
https://electrician-edinburgh.co.uk running 2017 theme and 2FA is ok
https://edinburgh-stair-lighting.co.uk running 2017 theme and wordfence disabled via plesk allows me to log on.
If I activate wordfence then 2FA kicks in and its fine but if I log out then log back in after 30 mins I get authorisation error.
Its the same with https://aew-electrical.co.uk running 1014 theme
Basically all 3 sites have the same plugins

Hi @andye20,

Thanks for your explanation. Could you please send a site diagnostic from all 3 of the sites mentioned above? It would be good to see in what way the others differ from the working site and maybe help us reach a conclusion with why 2FA isn’t working as intended for you.

You can send the diagnostic reports to wftest @ wordfence . com. Find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent them.

Note: For the fastest response time, please make sure and add any information or questions directly to this topic and not the email address above unless asked.

Thanks,

Peter.

Many thanks for your help Peter
I have just sent them in

Just to recap
electrician-edinburgh.co.uk 2FA and wordfence works fine

edinburgh-stair-lighting.co.uk wordfence disabled

aew-electrical.co.uk wordfence disabled

Hi @andye20,

Thanks for providing those diagnostics. The IPs used by the servers are the same, there are no significant scan issues, no connectivity issues between our servers and your site, and your login pages don’t appear to have any Javascript issues/conflicts that could be stopping the 2FA checks from loading properly in the front-end from what I, as a non-user, can see.

Despite the sites using almost the same plugin sets, which I acknowledge from your diagnostics, did you ever run the test on the 2 non-working sites with only Wordfence enabled? If you did, please confirm just so I know that’s been tried.

If you reactivate 2FA, could you view the browser console when you see the authorization error? You may see errors. Whether you do or don’t, could you please show me the console and error message on the login page using a service like Snipboard?

Thanks again,

Peter.

Hi Peter
Many thanks for your help on this and yes it has me baffled as all 3 sites are with the same host 2 have the same theme and plugins

I sent the “report by email on the working ” electrician-edinburgh.co.uk” site

And yes I activated Wordfence on both problem sites “aew-elecrical” & “edinburgh-stair-lighting.co.uk” then sent the report by email.

I also tried to log off the sites then log on again only to hit the same problem so went in via Plesk to disable Wordfence
electrician Edinburgh runs 2017 theme
aew electrical runs 2014 theme
edinburgh stair lighting runs 2017 theme

Hi @andye20,

As things have progressed quite far and this doesn’t seem to resolve no matter how back-to-basics we get with your enabled plugins etc., I’m wondering if there is some corruption or issue with the Wordfence security tables in your database on the affected sites.

Could you try either removing the Wordfence security tables (wp_wfls_2fa_secrets, wp_wfls_settings) manually on your deactivated sites, or re-enabling Wordfence and selecting Wordfence > Login Security > Settings > Delete Login Security tables and data on deactivation, then deactivating the plugin again. On your next activation this should recreate those tables.

If running Wordfence as a lone plugin, removing/reinstalling the plugin, then removing the tables all haven’t had an effect, it could be worth checking your error logs on the server when the authorization error displays during login. It could shed more light on the more specific nature of the error causing the message to appear in the front-end.

Thanks again,

Peter.

Hi Peter
Deleting the login security tables did the trick.
I even got 2FA back and working automatically on aew-electrical.co.uk but not on edinburgh-stair-lighting.co.uk but thats no big deal just now as I have wordfence back.

Once again many thanks for your help

Thanks @andye20 for the feedback, let us know in a new topic if you need assistance with Wordfence again!

Peter.