Users can’t login until I deactivate Wordfence

Hi, I’m having the same problem for around a year since I started using Wordfence. I didn’t mess with the settings a lot, just a basic recommended setup.
However, no one can log in to the website using the correct credentials. I have to rename the wordfence folder every time, then rename it back. Otherwise, it just says “Wrong password”.
I did a lot of searching around the forums but didn’t find a correct answer.
There’s no plugin conflict, too.

Just tried renaming the Wordfence folder, which allowed me to log in with the user’s credentials, but after naming it back it wouldn’t let me log in again. I contacted one of my plugin providers who said that WordPress deals with all the login info, so Wordfence must be blocking either the user or action and to try checking Wordfence to see if there’s a specific setting I need to configure. Problem is, I’ve checked everywhere in Wordfence and can’t find any specific login settings.

I just found this Wordfence tutorial. The heading “Immediately lock out invalid usernames” might offer the solution, but I can’t find the Firewall>Blocking option referenced at the end of this section in Wordfence.

Update: Okay, I found the Blocking menu. You have to enable it in the “All Options” menu. But when I looked at it, it’s not showing any blocks of any kind, so I’m not sure if this is the solution after all. :*(

• This reply was modified 4 years, 7 months ago by Eric Beaty. Reason: Found a feature

Okay, so I think I’ve finally solved the problem. I’ve decided to go with the security plugin All In One WP Security & Firewall by a developer called Tips and Tricks HQ. It allows me much better control over what features are enabled.

Anyway, the issue was mainly with the settings having to do with Captcha. Since the login screen for the plugin I use for my online courses does not offer a Captcha, only username and password, I obviously couldn’t check an invisible captcha box the plugins (both AIOWPS and WordFence) thought were on the page. And since it didn’t detect any such captcha box, I was naturally being blocked from logging in.

I’ve contacted my courses plugin developers about adding some sort of Captcha box on the login and registration pages for future instances of these types of problems.

I hope this helps anyone else who might be struggling with this issue. I’ve been able to enable most features in the AIOWPS plugin without locking anyone out. The steps I used to reproduce/troubleshoot this issue was to manually click each feature, log out of my admin account, then log into the course with the user’s info. If it let me log in to the course, I knew the feature could stay enabled; if not, I logged back into my admin account, disabled it, and continued checking the other security features this way, one at a time, until all of the features I could keep—without blocking customers/users—were enabled.

Definitely a long process, but now I have a secure site with more control that doesn’t block my customers!

I reached the same conclusion separately from the author and pretty much by luck. For some reason, my Captcha plugin setting was set on “Captcha v2”, even though from the beginning I’ve set it on v3 (I don’t know the difference, I just know that usually higher numbers mean something is gonna be better :)).
I’ve switched it to v3. It asked me to update the security keys. I did just that. The problem was suddenly gone — no more lockouts for 3-4 days already.
I didn’t suspect the issue was connected to Captcha plugin because when performing compatibility checks before, disabling the plugin didn’t help at all.
Updating the Version to 3 and security keys helped. I don’t understand the reason behind this, but I’m happy I don’t have to reconfigure the site for AIOWPS all over again. I was considering it, but for now, I’ll see if any more problems arise.