tomash78

Hello MJin,

Thanks for your feedback. Just did the update today and I confirm – the problem is solved :). I’m really glad!

Now I test LearnPress 4 and during 30 minut testing I put 5 topics on the eduma forum ??

Best Regards,
Tomasz

I wish you a good luck and if you get any answer – please share it with me ??

Best Regards,
Tomasz

I had sent them ticket too… They told me that they would look in to this problem but they need time. That was couple months ago and nothing happened. This ticket was ignored. Maybe you will have much more luck :D.

Best Regards
Tomasz

No, unfurtunatelly – it still exists. I got used to it, and telling the true it caused that I stopped to look at the statistics and reports generated by the Wordfence. I don’t want to be nervous ??

Best Regards,
Tomasz

@wfpeter,

Yes, I agree with you. I’m very grateful for your help and I wrote to Eduma (theme) support. They answerred that their developers will look at this ASAP… ?? I hope it won’t be long time.
One more time – thank you Peter for your hudge help!!! You and Wordfence are first class supporter and plugin!

Best Regards
Tomasz

Hi @wfpeter,

I think, your suspicions are just in point. I used Health Check & Troubleshooting plugin and when I switched to default theme, the traffic stopped. After I switched back to Eduma Theme – it started. In both cases I had enabled only woocommerce and wordfence.

Is that mean, that I should ask Eduma theme developers for help? I asked them on the begining but… they told me to go to You, as a Wordfence make this ‘trouble’.

I try one more time, but I feel like a ball ?? We’ll see.
Peter – if you have any idea – I’ll be glad to hear some news from you. If not – I’m very, very grateful for your hudge help!

Best Regards,
Tomasz

Hi @wfpeter,

I have prepared a clone of this problematic site and I have installed this Enable jQuery Migrate Helper plugin on my clone site. I set both settings: Default for WordPress and Legacy
https://prnt.sc/wlmxrl
Unfortunatelly – it didn’t help.

I deactivated all plugins except woocommerce and wordfence.
https://prnt.sc/wln036
And the abnormal traffic still exists. When I disable woocommerce – it stops.

I think I could have access to php.ini.

Thank you Peter for your help, maybe we check this php functions?

Best Regards,
Tomasz

Hi @wfpeter,

I’ve just sent the diagnostic raport, as you ask. On this page was displayed such a warning (maybe it is important):
https://prnt.sc/wi9ioc

Thank you Peter!

Best Regards,
Tomasz

Hi @wfpeter !

Thank you very much for this description! I appreciate it!
– I have enabled “Pause live updates when window loses focus”
– I could increase Update interval in seconds to 15 (now it is 2) but it I think it only mask the problem. I set it to 10.
– Similarly – switching to “security only” will only mask the problem. On my backuped copy of site (I have periodic backups of site) this live traffic is correct. There is no such a flood of requests.

Also, I have enabled Bruto Force and Rate Limiting. But all this solutions didn’t help to stop this flood.

There is some bug/problem with either Woocommerce or Wordfence which started some loop of requests in the past and I haven’t got any idea how to find the problem and fix it.
On my developers page I try to remove fully woocommerce (also removed tables and woocommerce plugin folder) and then install it from start. Doesn’t resolve problem. The requests are still present in live traffic window for 1 per seconds)

I have the newest version of woocommerce and theme and Wordfence, Woocommerce doesn’t shows any problems in its status pages.

“The reason the attempts start specifically when WooCommerce is enabled could be due to their alternative customer login pages being targeted as part of the attack.”

I think this is not a cause, because on my clone site created from backup this requests doesn’t exist ??

I cannot recover site from backups because this is a live website with courses and from that “good version of site” some new clients/students come.

Dear Peter, any other suggestions or ideas?
Thank you very much for your engagment.

Yes, you are absolutely right. This is default wordpress reset email. I’ve install other plugin to override default messages from wordpress and make emails more friendly. And this plugin works with all messages but not with password reset. I think it’s the problem with some security plugin (Wordfence?) as you wrote on this great page with troubleshooting from you.
I try to test it in this way ?? Thanks for help!