I get "spamming has been blocked" when trying to login to wp-admin

[mark_P]

I just started getting this message “Spamming has been blocked” when trying to login into wp-admin (my wp-admin is a different name for security reasons but I have always had it named differently, shouldn’t affect anything).

I was able to successfully login last night at 9:16 PM, but today I am unable to login to wp-admin, unless I disable Duo by renaming the Dua plugin directory.
I have temporarily disabled Duo by renaming the plugin directory so I can log in.
I have tried clearing my cache on both my browser and the web site.
When checking the Duo dashboard reports, the report does not even show a failed authentication.
I am at a loss of what else to check.

[DuoKristina]

That’s interesting. The message shown isn’t part of the Duo WordPress plugin. Might you have another WP plugin for spam that is misidentifying Duo? We already know of a few WP plugins that don’t play well with the Duo plugin.

Do you have access to your WP site’s logs to see more details about what triggers that message?

[mark_P]

Hi there,

Interesting hypothesis.

I use the following security related plugins:

Wordfence Security

WP Armour - Honeypot Anti-spam

I just tried disabling WP Armour, and sure enough, that is the software causing the problem.

Without that software running, our support email gets bombed by spammers. If I can’t get DUO and WP Armour to cooperate, I will have to replace one of them.

Looking at the error logs, I am seeing the following error:

[24-April–2023 04:00:10 UTC] Duo cookie with name: duo_secure_wordpress_auth_cookie not found. Start two factor authentication. SSL: 1

Mark

[DuoKristina]

I wonder if the WP Armour plugin is trying to treat Duo as a form it should modify and can’t, so then failing the spam check? Maybe there is a configuration option to prevent it from running on specific pages/forms, and you can then exclude it from the Duo prompt page?

The log line you quotes is just saying no existing cookie from a valid Duo 2FA success was found so therefore start the 2FA process.