Seems to conflict with iThemes Security since 3-4 weeks ago

Hi @alamana, thanks for reaching out.

Usually issues around compatibility with our 2FA comes down to whether another plugin changes the login flow from what Wordfence is expecting, or a custom form/page/URL is used through a plugin or theme. As you’ve tried disabling iThemes’ login-related elements, are you able to get them to work together as the only enabled plugins to ensure nothing else is interfering? Sometimes it’s also a good idea to switch to a default theme such as Twenty Twenty-Three at this time too, to rule out custom scripts in your theme.

If you’ve tried the above with no luck, send us a diagnostic through the Wordfence > Tools menu so we can look at your site. You can send that to us at wftest @ wordfence . com. Click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,
Peter.

Hi Peter, thanks for your reply!

After following your prescribed steps, the issue persists even with only those two plugins activated and a default WordPress theme.

I sent the diagnostics report as requested.

I’m the server administrator here; the weirdest part of this is that there’s nothing in the logs to suggest any failure occurred anywhere – no errors or warnings at all from what I can see.

It looks like upon an otherwise successful login it tries redirecting to the login page with the query string?interim-login=1&wp_lang=en_US and I suspect maybe that’s part of the issue, but I’m not sure if it’s Wordfence or iThemes that’s trying to do that.

Thanks again for your help!

I wondered if your team has had a chance to investigate this yet and whether they have any suggestions?

Thank you again!

@wfpeter I wonder if the team ever had a chance to investigate this?

Thank you again for any advice.

Just a friendly ping @wfpeter. I wonder if there were any clues? We’re still unable to use the two together.

@wfpeter could you please advise?

Hi @alamana,

I believe the query string visited after login is related to your previous session. The $interim-login variable exists in WordPress itself for when the log-in session of a user expires while working in /wp-admin, for example when an editor tries to auto-save. I have seen the site/user language preference appended under these circumstances too.

I wasn’t able to find any diagnostics with “alamana” referenced in the subject or body that’d ever come through to us, so this could either be related to a wider issue where your site isn’t sending emails either, or it could have been a temporary problem. I always check our spam folder just in case, too.

Are you able to download the txt version from the Wordfence > Tools > Diagnostics page and email it to us manually as an attachment? Don’t forget to include your username in the subject line, and once again let me know when you’ve sent it over. I’ll look at it today if you’re able to get it through to us.

Many thanks,
Peter.

Hi Peter, thanks for your reply – I will send the diagnostics now to wftest @ wordfence . com

Just an update – I sent the diagnostics immediately after my last message. I hope they might provide some insight. Thank you again!

Just a friendly bump @wfpeter

It seems like the problem might only affect logging in with a username – but logging in with an email seems to work. Is there some reason that might be based on the way things were coded in the plugin?

Thanks again!

The iThemes team uncovered the cause. I guess the setting previously didn’t work and now does.

https://www.ads-software.com/support/topic/unable-to-login-due-to-ithemes-but-reason-is-not-clear/page/2/#post-17087004