Title: Lockouts not working
Last modified: August 31, 2016

---

# Lockouts not working

 *  Resolved [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/)
 * The lockouts are no longer working (neither logins nor 404s).
    I am mostly concerned
   with the logins. Currently running the latest version (5.3.5), but the problem
   started while running an earlier version. Not sure when it stopped working. Updated
   to the latest version, tried changing settings, nothing helped. I can add an 
   IP to the “Ban Users” list and that works, but lockouts not working automatically.
   The admin user is not in use, and it does not get locked out either, though it
   is checked. Have several sites using this plugin, and they all work. Please advise…
 * [https://wordpress.org/plugins/better-wp-security/](https://wordpress.org/plugins/better-wp-security/)

Viewing 9 replies - 1 through 9 (of 9 total)

 *  [dwinden](https://wordpress.org/support/users/dwinden/)
 * (@dwinden)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258685)
 * [@poopypants](https://wordpress.org/support/users/poopypants/)
 * It seems to be working fine over here.
 * You don’t have any “Host or User Lockout” entries in the Logs page ?
 * Note there is a difference between a temporary lockout and a permanent ban (in
   case you missed that) 😉
    Also the IPs of failed “admin” user login attempts 
   are not immediately permanently banned (as the settings description suggests)
   but locked out temporarily.
 * dwinden
 *  Thread Starter [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258697)
 * No lockouts nor bans at all.
    Plenty of attempts in the log file. I have to put
   the IP into the Ban Hosts list manually. As I said, I have several other sites
   working fine with this plugin. I have been using it for a few years now…
 *  [dwinden](https://wordpress.org/support/users/dwinden/)
 * (@dwinden)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258707)
 * [@poopypants](https://wordpress.org/support/users/poopypants/)
 * Ok, so if I understand correctly we should see this as an isolated issue on a
   single site.
 * Permanent bans are triggered by a certain number of (host) lockouts (by default
   3) within a predefined timeframe (by default 7 days). No temporary lockouts means
   no (automatic) permanent bans written to the .htaccess file.
 * Are there any errors in the web server error_log ?
 * Did you try deactivating&deleting the plugin and then reinstalling&reactivating
   the plugin ?
 * dwinden
 *  Thread Starter [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258715)
 * Yes, isolated issue… Unless you have seen this before.
 * I understand how the lockouts/bans work.
 * Not sure about error log, have not looked.
 * Have not tried the plugin replacement method, was hoping to not have to do that…
   I guess I have to, though.
 *  [dwinden](https://wordpress.org/support/users/dwinden/)
 * (@dwinden)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258765)
 * [@poopypants](https://wordpress.org/support/users/poopypants/)
 * I’ve checked the lockout code and I think I’ve found a scenario that possibly
   explains whats going on.
 * To get some sort of confirmation please log into the database (eg by using phpMyAdmin)
   and check for the existance of any (temp_type=) “brute_force” records in the **
   wp_itsec_temp** table.
 * Adding a record to this table is the first step in the lockout process.
    Existance
   of 1 or more “brute_force” records in this table is the confirmation I’m looking
   for. I think the lockout process fails to execute the subsequent steps.
 * Note the Logs page displays records from the **wp_itsec_log** table.
 * Note you may be using a different database table prefix than the default (wp).
 * dwinden
 *  Thread Starter [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258790)
 * More info…
    I compared some database entries from another site, and confirmed
   some items: No records in the wp_itsec_lockouts table on the problem site. No
   lockouts in the wp_itsec_log table. (there are records)
 * Hope this helps…
 *  Thread Starter [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258795)
 * Looks like it dropped my previous post…
    Yes, there are “brute_force” records
   in the wp_itsec_temp table. Yes, the Logs page displays records from the wp_itsec_log
   table.
 *  [dwinden](https://wordpress.org/support/users/dwinden/)
 * (@dwinden)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258806)
 * [@poopypants](https://wordpress.org/support/users/poopypants/)
 * Ok, that fits the picture.
 * I think it is a file/folder permission issue.
 * Before the lockout is actually executed the plugin tries to create a file lock.
   If the file lock fails to be created the lockout code is not executed …
 * It looks like this:
 *     ```
       if ( $itsec_files->get_file_lock( 'lockout_' . $host . $user . $username ) ) {
   
       	//do lockout code
   
       }
   
       $itsec_files->release_file_lock( 'lockout_' . $host . $user . $username );
       ```
   
 * I’ve seen your issue in a previous topic and I can confirm it was resolved by
   setting proper folder permissions.
    The temporary lock file/folder is normally
   created in the wp-content/uploads/ithemes-security folder.
 * The above info should allow you to fix the issue.
 * dwinden
 *  Thread Starter [poopypants](https://wordpress.org/support/users/poopypants/)
 * (@poopypants)
 * [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258821)
 * OK, that did the trick!
    Thanks for your help… Cheers

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘Lockouts not working’ is closed to new replies.

 * ![](https://ps.w.org/better-wp-security/assets/icon.svg?rev=3529351)
 * [Kadence Security – Password, Two Factor Authentication, and Brute Force Protection](https://wordpress.org/plugins/better-wp-security/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/better-wp-security/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/better-wp-security/)
 * [Active Topics](https://wordpress.org/support/plugin/better-wp-security/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/better-wp-security/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/better-wp-security/reviews/)

 * 9 replies
 * 2 participants
 * Last reply from: [poopypants](https://wordpress.org/support/users/poopypants/)
 * Last activity: [10 years, 1 month ago](https://wordpress.org/support/topic/lockouts-not-working/#post-7258821)
 * Status: resolved