A Wordpress site I manage has the WordFence security plugin installed.
Legitimate users occasionally get blocked by the Brute Force protection aspect of the plugin, even though they haven't made any bungled login attempts.
When I look into the Live Traffic I see hundreds of invalid login attempts, mostly at /xmlrpc.php but some at /wp-login.php.
However, they don't look like hacking attempts, since they all use a blank username:
Mountain View, United States attempted a failed login using an invalid username "". https://my_domain.com/xmlrpc.php 5/2/2019 1:00:24 PM (22 hours 5 mins ago)
When I look up the IP addresses in WhoIs, it tells me that it's Google LLC.
Has anyone else come across this issue before?
Is it possible that some Google product, perhaps a Chrome browser tool, is inadvertently causing this issue?
Weirdly, when I blocked the IP address range of the attempts in WordFence, I was locked out of the site myself, even though my IP address isn't within the range.
PS: The site uses the W3 Total Cache plugin.