Wordfence thinks I’m a fake google crawler

Is your site using an external cache, such as Varnish? Usually you can find this in your hosting company’s control panel, if so — disabling it is usually best, as it can affect many parts of WordPress and Wordfence, and other plugins. (A cache may be saving an old token, which causes this message.)

Varnish or another cache can also cause the fake Google crawler message — once you are able to log in again, you will need to change the option “How does Wordfence get IPs” on the Wordfence options page. Depending on your server’s setup, you probably need to choose the X-Real-IP or X-Forwarded-For option, or if you also use CloudFlare, then choose the CF-Connecting-IP option. More details on the options are here:
How does Wordfence get IPs

After setting the option, you can verify it is working by looking at the Live Traffic page, and visiting the site in a separate browser where you are not logged in, and verify that your own IP appears in your own visits. (If Live Traffic is disabled, try logging in using the second browser, since logins and logouts are still recorded.)

-Matt R

Thanks for your answer. My host got the option to activate an external cache, but it’s currently not activated.

Any way to disable the blocking via phpMyAdmin, maybe?

regards,
Simon

The easiest way is to disable Wordfence by using FTP to rename the “wordfence” plugin folder. Detailed steps are included here:
Locked out and can’t get back in

There are also steps for disabling the firewall options using a second plugin, in case Wordfence would lock you out immediately after reactivating it. Once you are back in, I still recommend checking Live Traffic and the related option above — there may be something else unusual about your host’s setup even though the external cache is supposed to be off — the invalid security token and warning about fake googlebot when you visit the site definitely shouldn’t happen.

-Matt R

My temporary solution was to rename the plugin folder, yes. Now I’ve accessed the FTP from yet another connection, renamed the plugin again and turned off the feature that fake google bots get blocked immediately ??

Ok, great! Did you also check the Live Traffic page to be sure IPs are coming through correctly yet?

Normally, no real visitor should be blocked with this message, unless the site is seeing your own IP as the same as other visitors, because of some type of reverse proxy or external cache.

-Matt R