search

transitionnetwork / TNv3.0

New website iteration
GNU General Public License v3.0
0 stars 0 forks source link

Wordfence #139

Closed ainsliebeattie closed 7 years ago

ainsliebeattie commented 7 years ago

Hi - this is about the 10th one of these messages I have received in the last three days:

This email was sent from your website "Transition Network" by the Wordfence plugin at Monday 20th of March 2017 at 01:06:30 PM The Wordfence administrative URL for this site is: https://transitionnetwork.org/wp-admin/admin.php?page=Wordfence A user with IP address 79.79.147.149 has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 10. The last username they tried to sign in with was: 'paul.baker@phonecoop.coop' User IP: 79.79.147.149 User hostname: 79.79.147.149 User location: Bristol, United Kingdom

I have been told that it must be to lost links and pages not connecting properly - this wasn't happening last week - why the sudden increase? What do we need to do and is this an issue?

Many thanks

thisisyoke commented 7 years ago

Hmm, unfortunately Wordfence is a plugin that Sam requested we use, we have never used it before so are unsure of quote what this means. I will get Tom to look into it as it may be the settings of the plugin need amending

thisisyoke commented 7 years ago
arhinostorm commented 7 years ago

The blocking of people by IP is automatic. It's generally someone trying over and over to login to the site and failing. Most of those will be bots. Any wordpress site is a target for this, just so they can fill it will viagra ads. Here is a guide on what most wordfence message mean and which ones to pay attention to:

http://tallpoppiesdesign.com/what-to-do-with-those-user-locked-out-from-signin-in-wordfence-notices/

The too long / didn't read version is - most notices from wordfence can be ignored, it's some bot trying to login. Will take a look at why users are getting logged out next...

arhinostorm commented 7 years ago

I have tried easing off some of the wordfence settings as recommended here:

https://wordpress.org/support/topic/users-reporting-blocked-by-login-security-setting-messages/

For instance the setting 'Don't let WordPress reveal valid users in login errors ' has been unchecked.

I can not replicate the logging out error so far... I tend to use two browser, one for wordpress admin stuff, and then another for looking at the site (e.g. safari for admin stuff, at the same time looking at the site in chrome). I wonder if being logged in as admin and doing things around the site is the cause of the logout? People logging into the front end of the site are technically just users... so when you are logged in as an admin and browser the site, it thinks you are a user just like if someone registered and logged in.

samuk commented 7 years ago

I'm also unable to replicate the user logout issue. I'll ask people to let me know if it's an ongoing issue for them.

The notifications are the expected behavior as noted by Tom, so closing for now.