Wordfence blocking Say What? plugin

Hi @inoxys, thanks for reaching out.

I’ve run some tests and Wordfence isn’t blocking “Say What?” and I was able to successfully translate some Wordfence plugin strings so the likelihood is an incorrectly set text change (or the text you’re trying to change can’t be translated), or a conflict with another plugin that I don’t have.

If you want to check for a conflict, enable Wordfence and “Say What?” on their own to see if you’re able to change what you need. If you can, then reenable your other plugins until it stops working to find the source of the problem. This test may also need to be done with disabling your theme and instead reverting to a default like Twenty Twenty-Four in certain circumstances. However, this test would still fail if your original text change was incorrect, so I’ll explain my test which could be easily replicated.

In WordPress > Tools > Text changes, I decided that I wanted to change the screen reader text strings for “opens in new tab” to “?bner i ny fane”, which appears in the text domain “wordfence” as required by the Say What? documentation on changing a string.

As they suggest, I viewed the source of a page – in this case Wordfence’s lib/IPTrafList.php – and took note of the following code on line 24 to get that information:

<?php esc_html_e('opens in new tab', 'wordfence') ?>

After saving the change, I viewed the Wordfence > All Options page, right-clicked and inspected one of the grey “?” inline help icons, which showed the change in the live version of the page:

<span class="screen-reader-text"> (?bner i ny fane)</span>

If you have issues translating a different plugin, you’d need to reach out to support for that plugin or “Say What?” itself to see if they can assist.

Many thanks,
Peter.

Hi and thank you Peter, I appreciate your help.

Here is a new test I made (please ignore SSL warning error on clicking on the link).

Regards,
Florent

Hi @wfpeter ,

Here is the message from the Thrive Theme team:

Hi Florent,

I have troubleshoot the site again, and from the video you shared, it seems like the issue is indeed coming from Wordfence.

In Wordfence firewall settings, I whitelisted my IP address 136.158.58.176 (https://a.supportally.com/i/jSzkwn). The WordPress language set in the settings worked fine. I used software to change my IP address to 116.203.229.179, but the issue returned, and the WordPress form validation message was no longer being translated. I removed the software to use my IP address, which fixed the WordPress form validation message.

Please see these videos:

• Using my IP?136.158.58.176:?https://a.supportally.com/v/niDYID
• Using first the IP 116.203.229.179 and then my IP?136.158.58.176:?https://a.supportally.com/v/AAuqpE

I removed my IP address from Wordfence and switched to the WordPress Twenty Twenty-One theme. I temporarily deactivated all plugins except for UpdraftPlus and Wordfence, and the form validation messages didn’t translate.

Please see this video https://a.supportally.com/v/d4h8Bo.
Note: I restored the original state of the site after troubleshooting.

Could you kindly forward this to Wordfence support so they can provide the specific WordPress login parameter that needs to be whitelisted in Wordfence firewall settings?

We hope this information helps, and we look forward to your message.

Best regards,

Hi @inoxys, I have taken a look through the videos and screenshots.

With the initial video test, I believe the message is being translated into English because there’s an alternative (and untranslated) string for “The username or password you entered is incorrect” when you have Wordfence > All Options > Brute Force Protection > Additional Settings > Don’t let WordPress reveal valid users in login errors enabled. Try disabling this initially to see if it’s the source of the issue.

I was initially confused with why theme support was getting different results with IP changes, as I didn’t believe Wordfence was actually blocking the plugin or its translated messages. It’s now clearer I think that that allowlisting an IP bypasses all Wordfence security settings, so it’s skipping the above setting too.

Let me know if that changes anything,
Peter.

//Edit:

For reference, the error message for translation currently appears in Line 8262 of wp-content/plugins/wordfence/languages/wordfence.pot

• This reply was modified 4 weeks, 1 day ago by wfpeter. Reason: Added line number of translatable string

Hi Peter,

Thank you for your replay and idea.

I deleted the plugin because I saw in my test that WordPress already natively translate in french the error message. So Wordfence is overiding this WordPress native message.

I tried to deactivate the setting you told about but I still have the issue. Even in private navigation mode after clearing CDN et WPRocket caches.

If I replace the line Line 8262 of wp-content/plugins/wordfence/languages/wordfence.pot with the french translation I suppose I will lose it on each wordfence plugin update right?

Regards,
Florent

• This reply was modified 4 weeks ago by Florent.

Hi @inoxys, I’ve been running some tests.

There are two similar strings in the .pot file with slight differences, one for the main plugin and one for 2FA/captcha:

• lib/wordfenceClass.php
• modules/login-security/classes/controller/ajax.php

msgid "<strong>ERROR</strong>: The username or password you entered is incorrect. <a href=\"%2$s\" title=\"Password Lost and Found\">Lost your password</a>?"
msgid "<strong>ERROR</strong>: The username or password you entered is incorrect. <a href=\"%s\" title=\"Password Lost and Found\">Lost your password</a>?"

Is your site set to French by default in WordPress > Settings > General, or are you changing it with the dropdown on the login page? When using Russian as another test language, if we change the messages with Loco Translate, we?do?see the changed messages too.

Do you have any users with 2FA enabled, and please can you confirm that you haven’t enabled the reCAPTCHA? That wasn’t in the video, but I wasn’t sure if you’d been testing with/without.

Many thanks,
Peter.

Hi Peter,

I confirm that French is set as the default language, the language setting of the account I used to reproduce the issue is “default value of the website” and I didn’t change language on the login page.

I also confirm that we don’t use 2FA:

2FA Status – Inactive: Wordfence 2FA is inactive

Regards,
Florent

Hi Peter ! Any news for me?
Regards,
Florent