caseyctg

By the way, there is a multi-call option under “wordpress tweaks > Multiple Authentication Attempts per XML-RPC Requests”

Rather than trying the function above, see if setting that dropdown to “block” helps.

Same here, disabling that module fixed it. But I confirm the problem is within the class-itsec=lib.php get_module_path() function.

I had the same issue. I ended up white listing that particular url because of it. I wish they would fix the cause, but I think its only happening on a particular server version..

I just ran into this issue myself. I fixed it on my end but hopefully they’ll fix it within the core…

Affected file:
better-wp-security/core/class-itsec-lib.php

Affected function within that file:

public static function get_module_path( $file ) {

$path = str_replace( ITSEC_Core::get_plugin_dir(), '', dirname( $file ) );
$path = ltrim( str_replace( '\\', '/', $path ), '/' );

$url_base = trailingslashit( plugin_dir_url( ITSEC_Core::get_plugin_file() ) );

//$url_base is returning https://yoururl/wp-content/plugins/better-wp-security/
//fix...not returning correct path for strong passwords module...
//check if path is for the strong-passwords module and correct if so
//you'll need to change this to the xampp directory you posted
if($path == "C:/inetpub/yourapplicationpath/wp-content/plugins/better-wp-security/core/modules/strong-passwords"){
return trailingslashit( $url_base . "core/modules/strong-passwords" );
}else{
return trailingslashit( $url_base . $path );
}

}

I know its bad practice to hack the core, but I needed a fix without waiting…

I’m going through the same scenario with my site. The banned IP’s do not work on IIS. I wanted to ask if you know where the whitelist gets stored? I can see where the blacklist gets serialized and stored in the database, but cannot find the whitelist. I did find the itsec_temp_whitelist_ip option in the _options table.

Does the whitelist only get added to an htaccess file? I’m working on a custom ithemes additional class which queries the blacklisted and whitelisted ips, so I am curious where the whitelist gets stored.