Forgot Password request sends wrong key?

Thanks again. I didn’t rename the theme yet (was too frustrated last night to do any more, so decided to sleep it off and attack it this morning), but this morning I was able to login to the one site without getting the cookie message.

It’s strange because when I clicked the link to go to my admin panel for that site, it took me directly there, and so I didn’t need to login at all.

I can only assume the cookie was set at one of the many tries yesterday, even though the login page didn’t pick it up and wouldn’t log me in. I don’t get it, but I’m happy to be in to the one at least. I can’t thank you enough.

I’m still getting the cookie message on the other, but the other site didn’t have the plugins folder disabled until quite a while after the first.

Before I try renaming the theme, I’ll wait a bit and see if it resolves too. However, renaming the theme on this site is somewhat less of an issue because there’s nearly no visitors yet to be affected by it. If I have to do it, it wouldn’t bother me nearly as much.

It almost seems like a caching issue, but not a browser one since I did clear the cache several times yesterday and this morning.

The next question on the one I can login to is try and re-enable the plugins. I feel kind of “out there” without some sort of security plugin.

But I assume if I just rename the folder back to plugins, I may experience the login problem all over again. But I don’t know how to re-enable them one at a time when the folder itself is disabled.

Would I go into the plugins-renamed folder, and then rename each individual plugin folder to something else? I assume that would allow me to name the plugins folder back to “plugins” and then rename the plugins one at a time to see what affect each one causes?

I can only guess that if I don’t find out what caused, the same thing could happen again at any time … I’ve rather had enough of those kinds of frights 🙂

So I thought I’d pop back in and post the results of my recent problems, in case it helps anyone else out.

It took a while for everything to clear out, but I finally got back into the second wordpress site that I couldn’t access previously.

As it turns out, the issue seemed to be a relationship between using Cloudfare and wordpress, and the “Limit Login Attempts” plugin.

Even disabling Cloudflare didn’t resolve the issue.

Nor did disabling the Limit Login Attempts plugin. On the site I was first able to login, I deleted the plugin entirely, on the second site, I left it in the disabled folder, and renamed it to make sure it wouldn’t run.

I did all the other troubleshooting steps provided above by wslade (whom I couldn’t have managed without) but none of it worked. (It worked to some extent – I no longer got the wrong password notice, but got a notice that my browser didn’t accept cookies.)

I went ahead and completely deleted the Limit Login Attempts plugin entirely from the plugins folder in the cPanel file manager. Immediately after doing that, I was able to get back into the second account without having the cookie error.

Since then, I’ve re-enabled all my other plugins including WP Simple Firewall and Cloudflare and my caching plugins, and everything seems fine.

I did not reinstall Limit Login Attempts (note: Clouflare has been quite good above not letting IPs exhibiting that behaviour even reach the site, and blocking IPs in the Firewall works as well).

As useful as I found the plugin, it isn’t being updated or maintained, and since it really isn’t compatible with updated versions of WP it may no longer be safe to use, or may toss up weird errors (also note: this error may not have been caused by the plugin, but by my own lack of knowledge/experience).

Initially, it worked fine for several months, even though it was not tested on this version of WP, it worked.

The incompatibility issue was one that I probably created myself. It listed my own IP address as a whitelist item, with direct login. Once I changed the DNS to cloudflare, the Limit Login Attempts plugin saw me as accessing it through a proxy firewall, even though I had whitelisted cloudflare’s IPs.

Anyhow, at the moment, I’m just happy to be able to update my sites again.

To wslade – a thousand thanks!