First off, remove all but one of these.
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Unless you’ve done custom stuff and are very familiar with .htaccess, the only thing it should contain is one instance of the above. Once that is clean, you should be off to a fresh start.
Again, in your .htaccess file, make sure that this is wiped out
# BEGIN Hide Backend
# Rules to hide the dashboard
RewriteRule ^/wplogin/?$ /wp-login.php [QSA,L]
# END Hide Backend
To disable the plugin, find your plugins directory. You might have changed the name of the wp-content folder. Your plugins directory will be right next to your themes directory. Find the folder called better-wp-security and rename it something like XXX better-wp-security
Go to your wp-config.php file at the root of your installation and eliminate everything between
—
//Do not delete these. Doing so WILL break your site.
[Whatever you told ITSEC to put here when you were in the admin]
//The entry below were created by iThemes Security…
—
It should be at the very top of the wp-config.php page.
Or you can just comment out whatever lines are there. That should deactivate ITSEC and hopefully resolve some of your errors blarfing out.
Once that is done, you can re-install ITSEC, and choose the options carefully and knowingly, one at a time.
With familiarity, ITSEC is a joy to use, and one takes a perverse “F-U, hackers” pleasure every time one gets a report email.
