Plugins that might have issues and solutions to them
NOTE : This is by no means a complete list. On occasion some plugins may have an unforeseen issue because of the way they were written. This page is to document issues with plugins and what the fixes were.
Acunetix WP Security If you use our two factor authentication (also referred to as cell phone authentication), this plugin will likely cause problems. Acunetix WP Security, also know as WP Security Scan, prevents the status messages we send to the login page from being displayed. The authentication still works as normal, but the status messages might make it really confusing to anyone who wasn't aware of this. (Thanks to RandomQ for reporting this!)
Acunetix Secure WordPress This plugin changes the $wp_version variable, that is part of WordPress. This can cause strange results from the "see how file changed" option in Wordfence scans, and may cause issues with other plugins that rely on the WordPress version as well. (Last updated Oct 2014.)
Adminimize This plugin hides the wordfence menu, along with others like the plugins menu on the left side navigation of your admin area. The only way we found to view these two pages was to click on the adminimize menu and then wordfence or plugins. There is no reason we could find for this behavior.
AskApache Password Protect has been reported to interfere with Wordfence.
BP Profile as Homepage It has been reported by user Stefan D that this prevents the links to show file differences or the current file in scan results from displaying and instead sends the user back to their profile page.
Divi Builder may cause Wordfence to run slowly. Thanks to Chusman for the report.
Google Captcha (reCAPTCHA) by BestWebSoft changes WordPress's error codes for failed login attempts, which prevents the Wordfence option "Immediately block the IP of users who try to sign in as these usernames" from identifying invalid users. Additional login security options may be affected as well. Thanks to DareDevil73 for the report!
iQ Block Country Any plugin that uses the GeoIP library or provides geo blocking or geo detection features may have a problem with Wordfence. This includes the plugin “iq-block-country” which can’t run alongside Wordfence.
Limit Login Attempts If you are running the Limit Login Attempts plugin and are using our Two Factor Authentication, the first login (username and password only) that sends our code is counted against the total that the Limit Login Attempts plugin uses to determine if you will be locked out. This should be addressed in the next Wordfence release. Please also be aware that the Limit Login Attempts plugin is unsupported, hasn't been updated since 2012, and isn't even listed as compatible with any Wordpress version past 3.3.2. As always, Wordfence would like to remind you that using outdated, unsupported plugins is not recommended and puts your site at risk.
Memcached Redux / object-cache.php This plugin is over 2 years unsupported and breaks functionality in live traffic.
Paid Membership Pro The symptom:
You try to move your login pages behind ssl. You change wp-config.php by adding
Wordfence works more or less but any pages it creates, like the pages that show the differences between changed and original files, or system specifications by clicking the link at the bottom of the options page, show as blank pages or with a 404 not found http error. PaidMembershipsPro is the cause because it applies its own logic to force pages to be SSL or not, and in the case of Wordfence reports and some other things PMPro gets it wrong.
Postmatic can work well with Wordfence, but Wordfence's option "Hold anonymous comments using member emails for moderation" will prevent comments from being processed when they come in by email, since the user sending the comment cannot be verified. We recommend disabling this option if using Postmatic.
Query Monitor It was reported by our friend, John M, that this plugin can cause out of memory errors in Wordfence scans. It is recommended to deactivate this plugin during these scans if you have issues.
RetsPro (WPRealty) This plugin has been reported to make certain aspects of our plugin 'unclickable'.
shoutout to HMSRE for finding this one!
Restricted Site Access Is reported to cause issues with initial configuration
SI CAPTCHA Anti-Spam This plugin forces itself to run before anything else loads on the login page meaning that logins are not blocked and emails alerts for them are not sent. Thanks to Premium customer Richard D. for reporting this
Stop Spammers Spam Prevention This plugin's option "Check credentials on all login attempts" may cause Wordfence's Cellphone Sign-In option to be counted as failed logins, when the user's password is very long. If Wordfence's "Lock out after how many login failures" options is set below 5, it may cause lockouts even with a valid password. Disabling the option, or adjusting Wordfence's lockout setting will prevent the problem. Thanks to Premium user Russel for reporting the issue
Swift Security Bundle This plugin breaks scanning and many other features. It might have adverse effects on other plugin that make ajax calls as well.
Tribulant Newsletters This plugin may make Wordfence's caching page 'unclickable'. Temporarily disabling the plugin to make changes to the Wordfence settings is reported to work.
Thanks to IsItCoffeeYet for the report!
W3 Total Cache - We found that using the database cache function caused scans to fail. The error looked like this:
opendir(/directory/directory/wp-content/cache/db/000000/comments/): failed to open dir: No such file or directory (2) File: /directory/directory/wp-content/plugins/w3-total-cache/inc/functions/file.php Line: 82
Note : obviously the /directory/directory/ is the path to your web folders on the server and will be different
We recommend turning off database caching at the very least when scanning.
WPML Multilingual CMS - This is a multi language paid plugin. When using it if you set the option in settings > Language URL format to use different languages in directories, check the box for 'use directory for default language', and specify the directory (eg /en/) it will add /en/ to any path called including www.domain.com/wp-admin/admin-ajax.php
WP-Rocket works fine as far as we know but the writers have expressed concern about using live traffic while their cache is enabled. With our Falcon caching, which we believe is faster, we disable Live Traffic so that traffic is not impacted and because when some visitors are hitting php generated pages and some are not, hits recorded in Live Traffic could be off. The same could be true with any html caching plugin. This is why we disable it. WP-Rocket doesn't like that we disable it for our Falcon cache but don't guess if any other caching plugins are being used. So, if you are using WP-Rocket caching, turn off the Live Traffic.