Jonah1968

Update.

Just when I thought it couldn’t get any worse.

I have a primary domain hosted with Bluehost. This is just one of the domains that encountered issues with this plugin when it wouldn’t recognise my username and password and locked me out.

The issue was temporarily resolved by Bluehost who deactivated the plugin allowing me to gain access to the site.

I didn’t reactivate it.

Other issues with the plugin on sites hosted at Hostgator have caused multiple lockouts and 403 errors. Again, temporarily resolved by Hostgator.

Both hosting providers pointed at the plugin as being the issue and it overloading or changing the .htaccess files and causing issues.

No response here so far that is anywhere near a resolution.

How many functions do I need to turn off before this plugin works without causing issues?

Today I added a further domain through Bluehost via the addon domain function.

Then attempted to install wordpress onto that domain but it wouldn’t install. It gave an error message stating that there was issues with my .htaccess file and recognition of the URL.

Bluehost looked at it, gained me access that enabled me to install wordpress and stated that the .htaccess file was overloaded by security information. Tech support had to rename and create another .htaccess file to get access then advised not to use this plugin due to the data it stores and the changes it makes.

My primary domain on Bluehost was the only domain on Bluehost until today. It is thin and clean, doesn’t even have a theme installed yet, has two plugins (Akismet and Yoast SEO) and a coming soon page yet my .htaccess file was overloaded and causing all sorts of issues.

Also getting sick and tired of the messages from wmt of failed crawl attempts also. I can only assume that this is due to the Fake Googlebot setting also not be able to recognise the real Googlebot. Yet to be resolved.

All in all, not a great few weeks and hence tomorrow I will start the process of clearing this plugin from multiple sites and getting all .htaccess file cleaned up or replaced.

Given that my original post asked for any known issues and having not had a suitable response, I am left to assume that there are indeed issues with his plugin.

I would suggest that this plugin comes with some clear warnings and is unsuitable for anyone who is new or who is looking for a security solution that doesn’t actually create more issues that it is supposed to resolve.

Hi wpSolutions

I have 3 sites that have been affected with something over the last 2 days. These site are new with no content and few plugins. Just a coming soon page.

The plugin was stable for weeks but I can’t be sure but the only major change that I made for these sites was to go through the process of adding and verifying these with Google Analytics and Bing. Obviously adding the Analytics tracking code to the coming soon page etc. Would/could this have any bearing on the lockout issues I faced?

I subsequently issues accessing the site in one way or another. Either not recognising the username or password created, despite not having any issues with these usernames or passwords previously or returning a 403 Forbidden error before even getting to the admin login page.

I use two different Hosting services and each of these was required to deactivate the plugin and gain me access via the traditional wp-admin route.

Both stated that the plugin was the issue and one stated that it was overloading the .htaccess file with data?

To answer your question on what settings where in place for the Firewall and Brute Force, here they are.

Under the Firewall Tab in the dashboard I have the following settings:-

Basic Firewall Rules – All options are checked

Additional Firewall Protection – Trace and Track and Proxy Comment are checked

5G Blacklist Firewall Rules – This is checked

Internet Bots – This is checked (Could this be blocking the Googlebot and explain the ‘Robot.txt errors I am getting?)

Prevent Hotlinks – This is checked

404 Detection – This is checked

Custom Rules – Nothing placed here

Under the Brute Force Tab in the dashboard I have the following settings:-

Rename login Page – I used this originally but this was automatically reconfigured when I selected the Cookie Based Function.

Cookie Based Brute Force Prevention – This is checked and a secret word used that changes the admin login url

Login Captcha – All options are checked

Login Whitelist – Not used and left blank

Honey Pot – This option is checked

What would be your suggestion because I would like to keep this plugin.

Hi, thanks for the prompt response.

Under the ‘Brute Force’ heading I had enabled;-

Renamed Login Page Settings
Login Captcha
Honey Pot

I had not enabled the ‘Cookie Based Brute Force Function’ because I had already enabled the ‘Rename Login Page’ function.

I have now enabled the ‘Cookie Based Brute Force Function’ which has automatically disabled the ‘Rename Login Page’ function.

Seems that the ‘Rename Login Page’ function is a redundant function given that it didn’t do what it was supposed to do given that whoever was attempting to login was able to access the wp-login page regardless of me renaming that page.