Hi @meldev, thanks for reaching out to us.
I’m certain this is down to a false-positive so Learning Mode could possibly help you out.
From the Wordfence Dashboard click on Manage WAF. Then you will see Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. Now visit the page that was causing issues to teach Wordfence what’s happening is normal and should be allowed in future. After you have finished, switch the WAF from Learning Mode back to Enabled and Protecting.
If that doesn’t work, you can confirm if the issue is caused by a Wordfence firewall rule by taking a look at your Live Traffic. Do timestamps of your test visits to the page match blocked actions? You should be able to see which rule is causing the block by clicking that line (or “eye” icon) to expand it. Sometimes you are presented with a “ADD PARAM TO FIREWALL ALLOWLIST” button here that could solve any problems going forward. This button automatically inserts the URL and its required params to the Allowlisted URLs section of the plugin.
Note that turning OFF the option “Prevent discovery of usernames through /?author=N scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps” in Wordfence > All Options > Brute Force Protection > Additional Options can sometimes help, depending on the origin of the issue.
Let me know how you get on!
Peter.
