Broken 2FA and Buying Extort

Wordfence in its free version is a frustrating experience. While it claims to provide reliable login security, in practice it forces 2FA on all users, even those explicitly marked as exempt, such as students or subscribers. This breaks the login flow and makes the plugin unusable for sites that only want administrators protected with 2FA.

On top of that, the plugin constantly displays a buying extort banner (“complete the installation”) across the admin dashboard. This is not a technical requirement but a deliberate dark pattern designed to pressure site owners into purchasing the premium version. The intrusive yellow bar sits above the controls and needs to be dismissed, making daily administration unnecessarily unpleasant.