Cloudflare blocks 2FA login code sending
Cloudflare bot protection blocks the plugin's 2FA code emails even after custom WAF exceptions are added.
1 public report · first reported 5 June 2026 · last reported 5 June 2026
What's going wrong
Site owners using Cloudflare's free plan with strict Bot Fight Mode report that the plugin's two-factor login codes fail. Cloudflare returns a 403 block on the code-sending endpoint, and adding custom WAF rules, relaxing browser integrity checks, and purging the cache did not help. The plugin routes authentication through its own external servers, which Cloudflare reads as bot traffic. One user replaced the plugin with a fully local alternative. The gap is a tool that tests and fixes firewall rules for login endpoints on sites behind Cloudflare.
AI-assisted: written with the help of AI from the reports.
Products affected
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.