Hackers changing Wordfence settings?

  • Resolved fluencyNEWS

    (@fluencynews)


    8 years, 9 months ago

    Despite the fact that my webhosting provider (SiteGround), the Sucuri plugin, and Wordfence itself reporting my site as clean, I appear to have a problem with hackers changing my Wordfence settings.

    In particular, the following Rate Limiting Settings :
    * If anyone’s requests exceed … and
    * If a crawler’s page views exceed …

    When I setup Wordfence for the first time, I set both values at 240 per minute.

    At least three times in the last four days I have found them set to 960 per minute.

    This is NOT value I have ever used.

    Plus, as I said, it has happened at least three times the last several days.

    Any ideas / suggestions as to what is happening and/or how to identify and stop the problem, if any?

    Thanks,

    LJ Stevens

    https://www.ads-software.com/plugins/wordfence/

Viewing 3 replies - 1 through 3 (of 3 total)

  • Hi LJ (fluencyNEWS),

    Is it possible your settings are not saving at all? Make the changes, save, and refresh the options page right away and check if they have reverted back.

    I believe 960 is the default settings for those on Security Level 3. Out of curiosity, is that what is selected for the security level option?

    Sometimes there is an issue where options just do not save correctly. You can try checking the box next to “Disable config caching” at the bottom of the Wordfence Diagnostics page and try saving your settings again.

    Let me know how it goes!

    Reference: https://docs.wordfence.com/en/My_options_don%27t_save._How_can_I_fix_that%3F

    Thread Starter fluencyNEWS

    (@fluencynews)

    Hi!

    Thanks for the reply.

    I followed your suggestion, and it appears you are partially correct.

    What was happening is that the site was under attack, and I got tired of playing “Whack a Hacker,” which is what I call keeping a Wordfence Live Traffic window open while I work on other things and immediately blocking the IPs and/or networks of those Wordfence identifies as behaving suspiciously.

    So, I changed the security level to Level 3 and then Level 4. Whenever I changed the security level, the options below it changed as well.

    Makes sense now that I know what was happening and why.

    Normally, I would simply have done more troubleshooting on my own. But since it occurred in the middle of a 5 day assault on the site, I was hyper-sensitive to potential problems and wanted to make certain I dealt with whatever is was A.S.A.P.

    Now that I know what was happening, I’ll simply get used to the idea that I have to reset everything to my normal preferences whenever I return to a lower level of security.

    Thanks again,

    LJ Stevens

    Glad you found a solution!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Hackers changing Wordfence settings?’ is closed to new replies.