Troubleshooting

I am blocked by the attempt limit

The block is per IP address and lasts for the window you set (default 30 minutes). Sign in from another connection, such as a phone on mobile data, or wait. Once in, the audit log shows the failed attempts; if they were not yours, someone was guessing at your username.

Locked out of two-factor

• Lost the phone: sign in with one of your recovery codes, then reset and re-enrol from your profile.

• No codes, but another administrator exists: ask them to reset you under Settings → 2FA Enrollment.

• Only administrator, nothing left: deactivate the plugin from the server and re-enrol after signing in. With WP-CLI:

  wp plugin deactivate fluent-security

  Or rename the fluent-security folder under wp-content/plugins over SFTP. Reactivate afterwards; settings are kept.

Two-factor or magic-login emails do not arrive

The emails go through wp_mail(). If password-reset emails from WordPress itself also fail to arrive, the host has no working mail setup; install FluentSMTP or another SMTP plugin. If those arrive and FluentAuth’s do not, check the spam folder and the From address under System emails → Template: a from address on a domain that is not yours is often rejected.

Everyone is blocked at once, or the log shows one IP for everybody

The site is behind a proxy or Cloudflare and every visitor arrives from its address. Cloudflare is detected automatically; any other proxy has to be declared. See Visitor IP and proxies. Until it is, the attempt limit is counting all visitors as one.

A social login button does not appear

In order: Enable social login / signup is on; the provider is on; the credentials are present (a wp-config constant with a typo counts as absent, and the screen says which method it is reading); and, for the front-end forms, Enable custom auth forms is on.

redirect_uri_mismatch and similar provider errors

The URL registered with the provider does not match the login URL character for character. Compare scheme (https), host (www or not), and path. Each provider page lists its common errors: Google, GitHub, Facebook.

An IP rule locked me out

Add define('FLUENT_AUTH_DISABLE_IP_RESTRICTION', true); to wp-config.php, sign in, fix the rule, remove the line. See IP access rules.

The scanner reports changes to files I did not touch

Common causes: a host that patches core files (some managed hosts modify wp-config.php or drop in object-cache.php), a caching plugin’s drop-in, or a plugin you updated outside the WordPress updater. View diff shows what changed. If it is expected, Ignore it or take a fresh baseline. If it is not, Recovery.

Application passwords stopped working

Block application passwords is on under Core Security. Turn it off if a remote app needs them. Application-password logins also count toward the attempt limit and need a second factor when the user’s role requires one.

Redirect rules are ignored

The redirect_to parameter on a login link, and a shortcode’s redirect_to attribute, take priority over the rules for that login. Check the link the user clicked. Also check rule order: the first matching rule wins.

Conflicts with another security plugin

Two plugins limiting login attempts will block each other’s counts, and two plugins hiding the REST users endpoint can leave the block editor unable to load authors. Run one. FluentAuth’s own feature list shows which jobs it covers.

Getting help

• The support forum on WordPress.org.
• Bugs and feature requests: GitHub issues.

Include the plugin version, WordPress and PHP versions, and the relevant rows from the audit log with addresses redacted if you prefer.