Author link broken on New Post notifications

Hi there!

When did you start noticing this issue? I can see that there are some redirection plugins installed on your site. Did you install those to try and fix the problem?
If not, could you please disable them temporarily and check if the issue persist?

Hi! It was reported on 23rd October, but it may have been like that for a while. I’ve disabled the redirect plugins – I was just looking at ways to fix the problem with those. The author link with the query string still goes to a 404. The author’s ID is correct. And the post URL with a query string which is also displayed on the email works fine. https://oasishr.com/?p=54882

So, the ironic thing here is, we always use the query string links because they’re shorter, and they’ll always work, no matter what your permalinks are set as.

For example, https://jetpack.com/?p=82923 and https://jetpack.com/?author=11564206

Can you confirm that 3425 is the correct ID for the author who wrote the post with the problem?

You can confirm that in the Users section of your Dashboard when you edit the user. The URL on the edit page will be /wp-admin/user-edit.php?user_id=[number] so in this case we’re expecting /wp-admin/user-edit.php?user_id=3425

User ID is correct – it is https://oasishr.com/wp-admin/user-edit.php?user_id=3425. I checked a few other user’s IDs in the format https://oasishr.com/?author=XXXX and all go to 404 page. Just changing the user ID on the admin user-edit URL works fine though. And the query string post URLs work fine too – it just seems to be the author ones that are broken.

Ah, ok, so something is a bit broken in WordPress itself, not Jetpack.

Do author query strings work with all plugins switched off?

If not, do they work under the default Twenty Nineteen theme?

actually they do work when plugins are switched off!
so now I just have to find the one….

When I deactivate Wordfence the link works again

There is a firewall setting in Wordfence that causes the error
Prevent discovery of usernames through '/?author=N' scans, the oEmbed API, and the WordPress REST API
Once that is unticked the author URL works fine. But am I now open to brute force attempts to discover usernames, and does that matter?

Jetpack actually has its own brute force protection feature: https://jetpack.com/support/protect/ ??

Will check it out. Thanks for your help James!