This documentation is only valid for older versions of Wordfence. If you are using Wordfence 7 or later, please visit our new documentation.

Plugins that might have issues and solutions to them

From Wordfence Documentation
Revision as of 16:48, 25 February 2016 by WFMattr (Talk | contribs)

Jump to: navigation, search

NOTE : This is by no means a complete list. On occasion some plugins may have an unforeseen issue because of the way they were written. This page is to document issues with plugins and what the fixes were.

Acunetix WP Security If you use our two factor authentication (also referred to as cell phone authentication), this plugin will likely cause problems. Acunetix WP Security, also know as WP Security Scan, prevents the status messages we send to the login page from being displayed. The authentication still works as normal, but the status messages might make it really confusing to anyone who wasn't aware of this. (Thanks to RandomQ for reporting this!)

Acunetix Secure WordPress This plugin changes the $wp_version variable, that is part of WordPress. This can cause strange results from the "see how file changed" option in Wordfence scans, and may cause issues with other plugins that rely on the WordPress version as well. (Last updated Oct 2014.)

Adminimize This plugin hides the wordfence menu, along with others like the plugins menu on the left side navigation of your admin area. The only way we found to view these two pages was to click on the adminimize menu and then wordfence or plugins. There is no reason we could find for this behavior.

AskApache Password Protect has been reported to interfere with Wordfence.

BP Profile as Homepage It has been reported by user Stefan D that this prevents the links to show file differences or the current file in scan results from displaying and instead sends the user back to their profile page.

Divi Builder may cause Wordfence to run slowly. Thanks to Chusman for the report.

Google Captcha (reCAPTCHA) by BestWebSoft changes WordPress's error codes for failed login attempts, which prevents the Wordfence option "Immediately block the IP of users who try to sign in as these usernames" from identifying invalid users. Additional login security options may be affected as well. Thanks to DareDevil73 for the report!

iQ Block Country Any plugin that uses the GeoIP library or provides geo blocking or geo detection features may have a problem with Wordfence. This includes the plugin “iq-block-country” which can’t run alongside Wordfence.

Limit Login Attempts If you are running the Limit Login Attempts plugin and are using our Two Factor Authentication, the first login (username and password only) that sends our code is counted against the total that the Limit Login Attempts plugin uses to determine if you will be locked out. This should be addressed in the next Wordfence release. Please also be aware that the Limit Login Attempts plugin is unsupported, hasn't been updated since 2012, and isn't even listed as compatible with any Wordpress version past 3.3.2. As always, Wordfence would like to remind you that using outdated, unsupported plugins is not recommended and puts your site at risk.

Memcached Redux / object-cache.php This plugin is over 2 years unsupported and breaks functionality in live traffic.

OIO Ad Manager plugin This plugin may cause your ip address to be flagged as a fake googlebot.
Special shout out to premium member John B who found this problem and reported it

Paid Membership Pro The symptom:
You try to move your login pages behind ssl. You change wp-config.php by adding
define('FORCE_SSL_ADMIN', true);
Wordfence works more or less but any pages it creates, like the pages that show the differences between changed and original files, or system specifications by clicking the link at the bottom of the options page, show as blank pages or with a 404 not found http error. PaidMembershipsPro is the cause because it applies its own logic to force pages to be SSL or not, and in the case of Wordfence reports and some other things PMPro gets it wrong.
The solution:
The solution is to either switch off the forced SSL within PMPro (you then have to set their register pages etc. to SSL manually) or to switch PMPro over to "Force SSL (use javascript)" - that seems to be compatible with Wordfence. From forum post.

Postmatic can work well with Wordfence, but Wordfence's option "Hold anonymous comments using member emails for moderation" will prevent comments from being processed when they come in by email, since the user sending the comment cannot be verified. We recommend disabling this option if using Postmatic.

Query Monitor It was reported by our friend, John M, that this plugin can cause out of memory errors in Wordfence scans. It is recommended to deactivate this plugin during these scans if you have issues.

RetsPro (WPRealty) This plugin has been reported to make certain aspects of our plugin 'unclickable'.
shoutout to HMSRE for finding this one!

Restricted Site Access Is reported to cause issues with initial configuration

SI CAPTCHA Anti-Spam This plugin forces itself to run before anything else loads on the login page meaning that logins are not blocked and emails alerts for them are not sent. Thanks to Premium customer Richard D. for reporting this

Swift Security Bundle This plugin breaks scanning and many other features. It might have adverse effects on other plugin that make ajax calls as well.

Tribulant Newsletters This plugin may make Wordfence's caching page 'unclickable'. Temporarily disabling the plugin to make changes to the Wordfence settings is reported to work.
Thanks to IsItCoffeeYet for the report!

WP-Minify – We received reports that it incorrectly compresses Javascript and breaks other plugins like the “HMS Testimonial Widget” and Wordfence’s javascript. The user said that removing this plugin fixed Wordfence and the Testimonial Widget. This plugin is over 2 years unsupported.

WPML Multilingual CMS - This is a multi language paid plugin. When using it if you set the option in settings > Language URL format to use different languages in directories, check the box for 'use directory for default language', and specify the directory (eg /en/) it will add /en/ to any path called including

WP-Rocket works fine as far as we know but the writers have expressed concern about using live traffic while their cache is enabled. With our Falcon caching, which we believe is faster, we disable Live Traffic so that traffic is not impacted and because when some visitors are hitting php generated pages and some are not, hits recorded in Live Traffic could be off. The same could be true with any html caching plugin. This is why we disable it. WP-Rocket doesn't like that we disable it for our Falcon cache but don't guess if any other caching plugins are being used. So, if you are using WP-Rocket caching, turn off the Live Traffic.