Hi.
Option 1: I’ve just scanned the request. It is calling the action “wordfence_testAjax”. If you add this to the “Action-Whitelist” without the apostrophs. The test will succeed.
But to be quite honest I would recommend you to choose option 2, as I guess that Wordfence is using the action “wordfence_testAjax” just for testing the connection. For real connects they may use other ajax-actions. Therefore I’ll ask them how Wordfence-communication can best be whitelisted.
Option 2: Another way is to switch the plugin to “Explicit mode” by checking the option with the same name. This means that ajax-requests are not blocked any longer in except for those that you list explicitly with the option “Explicit actions”. To get the actions that your forms use, just submit your forms (before switching to explicit mode) and check in the messages inbox for the parameter actions. If any is given, just copy the respective action to the explicit list. If none is given, those forms don’t use ajax and are blocked even in “explicit mode”.
If you are using Forminator for instance just enter “forminator_submit_form_custom-forms” (without the apostrophs) at the option “Explicit actions”. If you have forms that are not built with forminator, you just proceed the same way to list them explicitly
I hope that helps & thanks for your hints.
Cheers, Matthias
Hi Matthias,
how are you? I hope you are well!
Thanks for the answer, I will see.
Maybe I need see also how to not have false positives with other extension like “Shied Security” or “User Switching” or other extension too 🙂 because I noticed that if I choose to store successful and spam message I get a lot of messages that are not generated by spam or bots but are internal plugin requests. 🙂 so maybe the conflict issue is not only with Wordfence.
I will look, thanks for the help for now 🙂