Wordfence keeps kicking me out – protected page problem?

A little update: it seems like it has to do with my new IP. Wordfence says this IP (which the domain / website is using now) is continuously trying to login so it’s blocking it.

Is there a way I can fix this?

Thanks!

Yes, it sounds like you may need to change the option “How does Wordfence get IPs” on the Wordfence Options page — is it a new host or server, or just a new IP address on the same server?

The options for this field are explained here:
https://docs.wordfence.com/en/Wordfence_options#How_does_Wordfence_get_IPs

After changing the option, you can check on the Live Traffic page. (If you have caching turned on, you may need to turn it off, to enable live traffic.) When the option is set right for your server, you should see different IP addresses for new visits on the Live Traffic page.

Thanks for the quick reply! It’s the same server, just with an added IP specifically for this website so I don’t think this setting is the problem.

I changed it anyway though, but the problem is still there. I’ve asked my host to see if they can help and will get you posted. Any other ideas are welcome of course ??

Which option(s) did you try in the drop-down list for “How does Wordfence get IPs”? The most common ones are X-Real-IP or X-Forwarded-For, but it depends on your host’s setup. If you are still seeing login attempts coming from the server’s own IP, then Wordfence isn’t able to see the correct IP.

It might be that your original IP is whitelisted and the new one isn’t — but when an IP is whitelisted, and all login attempts appear to come from that IP, that would mean that anyone attempting to log in wouldn’t be blocked.

Also, do you know if your host is using a “reverse proxy”? It might be Varnish, nginx, CloudFlare (which is a little different), etc.

I just tried the first 2. But since the first 1 was always working fine – before I appointed the website the new ip – I assumed that is not the problem.

My original IP wasn’t whitelisted, but what I did now is simply whitelist the new IP in wordfence, that solved all issues. That won’t harm right?

If the IP addresses for all visits are still showing up all as the same address, that is still a problem — no one will be blocked, including malicious visitors. (Whitelisting the server IP won’t be a problem after the IP addresses start coming through correctly.)

Can you try the X-Real-IP option, or the X-Forwarded-For option, and see if the traffic starts showing different IP addresses after that?

hmm yes I think you were right. They were all showing as the same address – the one of the website. I used x-real and now i’m seeing other visitors.

Great! That should also fix the original problem, where you and other people were getting locked out. There was probably something in the host’s settings that was different for the new IP, from how it was set up for the original. At any rate, let us know if any other issues come up.

I am suddenly having ip spoofing on a several of my sites, all on the same server. And I did get locked out from logging in on one, but got in using the unlock email request.

One showing the User IP as the web domain IP is for “Exceeded the number of page requests per minute for humans.”

And the other showing the User IP as the web domain IP is for “has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username ‘mike’ to try to sign in.“

The How does Wordfence get IPs: is set do the default “Let Wordfence use the most secure method….”

It is sudden so I am assuming the host may have moved things around? Should a change “How does Wordfence get IPs”?

@sandyjuettner242: Yes, it is likely that the host added a reverse proxy. I would recommend checking with the host to see what they are using, but you can also try setting the “How does Wordfence get IPs” option to “X-Forwarded-For” or “X-Real-IP”, and see if the IPs appear correctly on the Live Traffic page afterwards.

If you still have trouble, please make a new post using the form at the bottom of the Wordfence forum here. (This post was already resolved, so this will help make sure your issue is addressed.)

Thanks!

-Matt R