Defender and a lot of User login fail

Hi, I use Defender and been seeing a lot of User login fails lately. I tend to try and find out where the IP address is from sometimes because I'm worried that I might block a plugin that needs to access my site, however I keep seeing IP adresses that, seem to be from Cloudfare. Do you know if that would be from someone be redirected by Cloudfare or if Cloudfare it's normal to see that kind of behaviour from Cloudfare?

    Katya Tsihotska

    Hi Stephanie

    How are you today?

    I use Defender and been seeing a lot of User login fails lately. I tend to try and find out where the IP address is from sometimes because I'm worried that I might block a plugin that needs to access my site

    User login fails related only for users when they try to log with wrong username or/and password. You may not worry about that you block any plugins or services that need to access to your site. External plugins are accessing to your site using special requests or API, there is no need for them to log in to your site as a user.

    however I keep seeing IP adresses that, seem to be from Cloudfare. Do you know if that would be from someone be redirected by Cloudfare or if Cloudfare it's normal to see that kind of behaviour from Cloudfare?

    This is normal if you are using CloudFlare on your site. It happens because CloudFlare acts as a proxy, this means that your visitors are routed through the CloudFlare network. If you need to see original visitor's IP you can try to install CloudFlare plugin https://wordpress.org/plugins/cloudflare/. It restores the original IP to your WordPress logs and helps you do some CloudFlare optimization directly from your WordPress Dashboard.

    If you have any additional questions please let me know and I’ll be happy to help.

    Kind regards
    Katya