Repeat 500 Errors

I was excited about this plugin when I first saw it but I’ve been having a nightmare with it for the past week.

It started with a bunch of brute force attack attempts using the main admin user username. The login attempts were coming via XMLRPC, which I have now disabled. (they were getting the username from the author page archive I think).

Anyway, the admin account got locked out I think. Or maybe it wasn’t locked out and there was some other issue. The admin account kept getting a 500 internal server error when attempting to log in.

When the website owner gave me his admin info and password I was able to successfully log in. But he still is getting 500 errors.

I told him to clear his cache and delete browser cookies and try again. Before I personally tried logging in I deleted the lockout entries from the ithemes database manually on phpmyadmin. I also deleted the ithemes temp entries on the database.

I also deleted all the ithemes rules in .htaccess and then resaved ithemes settings so that it would rewrite the rules.

The website owner had whitelisted his IP, so just in case that was somehow the problem I un-whitelisted his IP.

I can still personally log in fine but the owner continues to get 500 errors. Any ideas?

URL is crestwoodpainting.com

Thanks a mill for your input!

https://wordpress.org/plugins/better-wp-security/