Problem
When a former WooCommerce customer tries to reset their password, they may not receive the standard “Invalid username or email” message. Instead, the system may appear to have successfully sent a password reset link, causing confusion since the email never arrives. This occurs because security plugins, such as Wordfence, are configured to prevent the disclosure of valid usernames, a common security practice to thwart brute-force attacks.
Explanation
Wordfence, by default, uses a setting called “Don’t let WordPress reveal valid users in login errors.” This feature is designed to obscure whether a username or email exists in the database. While this is an excellent security measure for login attempts, it can interfere with the password reset process. When a user enters an email that is not in the system, Wordfence intercepts the standard WordPress error message and provides a generic response, leading the user to believe the password reset request was processed.
Solution
To resolve this specific issue and ensure users receive the correct error message, you can adjust the Wordfence firewall settings.
- Navigate to the Wordfence Firewall: From your WordPress dashboard, go to Wordfence > Firewall.
- Access Firewall Options: Click on the Firewall Options tab.
- Find the Brute Force Protection section: Scroll down to the Brute Force Protection section and expand it.
- Disable the specific setting: Uncheck the option labeled “Don’t let WordPress reveal valid users in login errors.”
- Save Changes: Be sure to save your changes to apply the new setting.
By unchecking this box, you are instructing Wordfence to allow the standard WordPress error messages for invalid users, thereby ensuring that ex-customers receive the proper notification and understand why their password reset request failed. While this slightly reduces a specific type of login security, it significantly improves the user experience and reduces customer support inquiries for this common issue.