Wordfence reads the Cloudflare edge address instead of the real client address. The plugin does not receive the CF-Connecting-IP header or the header is not enabled, so it logs the edge IP as the visitor. When Cloudflare rotates its edge pool, the new address may already exist on Wordfence’s block list. A surge of failed logins from bots pushes the edge IP over the login‑failure limit, resulting in a permanent lockout.
The mismatch between the true client IP and the recorded Cloudflare IP causes Wordfence to treat legitimate admin traffic as malicious. The lockout appears as a 403 or 401 response on the login page and triggers email alerts from Wordfence.