Error 500 from WordFence with 2 plugins

Hi @harryfear, thanks for getting in touch and providing detailed information.

If you were seeing a 503 at login, I’d say one of the plugins is incorrectly triggering WordPress login-related hooks without data, so they’re counted as failed logins. The Wordfence option, “Immediately lock out invalid usernames” (when enabled) could be triggered by WordPress Persistent Login in particular.

That 500 error should be appearing in your PHP and/or server error logs, which should explain more detail around what’s happening when the error is thrown. Usually, if Wordfence allows you to log in when its the only plugin enabled, one of the other two is the cause of the conflict. However, if you do have supporting logs then we can confirm whether this is the case.

After regaining access to your site, feel free to send a diagnostic report to wftest @ wordfence . com so I can look for other possible configuration issues. You can find the link to do so at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,

Peter.

Hi Peter,

Thank you for this. I’ve sent the Diagnostic report using the built in tool from the sandbox site “wppldemo.duckdns.org”.

The WordPress Persistent Login plugin developer might also get in touch with you.

It looks like WordFence is blocking WordPress Persistent Login from invoking a core WordPress function called ‘wp_set_auth_cookie’:

Within /classes/wp-persistent-login.php, there is a line that uses the wp_set_auth_cookie core wordpress function.

Commenting this line out removes the problem, but without it users will not remain logged in forever.

The usage of the function is fine, there isn’t an error in Persistent Login or incorrect code.

Digging into Wordfence, they use a filter that is called inside wp_set_auth_cookie which triggers some of their login security code, again there isn’t anything wrong with that code as far as I can see, but commenting it out resolves the issue too.

Source

I hope this can help illuminate.

Best,

Harry

Any news on this, Peter? Did you get the log through email?

Hi @harryfear,

Sorry, but I didn’t receive the diagnostic in our inbox or spam folders. Did you attach your forum username to the message? If you did, there could be a chance mail isn’t sending from your staging site. You can export a diagnostic from this page and send it as a txt attachment from your regular email account if you prefer – but please include your forum username in the subject so I can find it.

I’ve reviewed the other thread and suspect that the plugin might be affected by the fact that WordPress currently only supports the default login/registration pages for 2FA and reCAPTCHA on WooCommerce and WordPress default pages. Do you have either of these features enabled or is it simply a username/password combination with no other login elements that fail?

Plugin developers who wish to suggest integration or point out an issue can contact genbiz @ wordfence . com to see if we can work with them.

Thanks,

Peter.

Hi Peter,

I have resent the email and also archived it here:
https://wppldemo.duckdns.org/wp-content/uploads/2022/04/email.html

Also, I’ve shared the new email address with one of the plugin developers:
https://www.ads-software.com/support/topic/latest-version-breaks-some-sites/page/2/#post-15488740

Kindly let me know what you guys can do.

I’ve not heard back from WordFence, which is disappointing. The diagnostic file is archived here:

https://web.archive.org/web/20220419221425/https://wppldemo.duckdns.org/wp-content/uploads/2022/04/email.html

This now issue seems resolved on these versions:

Admin Menu Editor – Version 1.10.2.
Wordfence Security (wordfence) – Version 7.5.10.
WordPress Persistent Login (wp-persistent-login) – Version 2.0.5.

The reason is still unknown, as to why these was a problem with these older versions in combination:

Admin Menu Editor – Version 1.9.7.
Wordfence Security (wordfence) – Version 7.5.9.
WordPress Persistent Login (wp-persistent-login) – Version 2.0.0.

Shame to say it but I spoke to soon. This issue still persists. Error 500 once you log out and log in again.

I’m in the same boat, just tried this plug in on a test web site and got totally locked out.

Hi!

I am having the same problem!

I have had to deactivate the Persistent Login plugin to make my site works.

I have tried to deactivate the Brute Force Protection from Wordfence but it doesn’t resolve the issue.

Did you have any luck?

Cheers,

There’s still no fix for this, which is really sad. And WordFence support have just disappeared off the face of the earth.

An Admin Menu Editor alternative could be WP Custom Admin Interface:—
https://en-gb.www.ads-software.com/plugins/wp-custom-admin-interface/

Persistent Login doesn’t have any perfect alternatives. The closest is Remember Me:–
https://www.ads-software.com/plugins/jonradio-remember-me/

I don’t know of any free strong firewall alternatives to WordFence.