Several bugs that effect all users, refusing to fix & rude support…

Hi,

I wasn’t in any way abusive, rude, disrespectful or attacking… you’ve even gone and deleted the thread on your website so I can not prove my innocence which in effect shows that I was innocent. Which you and I both know that I wasn’t any of those things.

Bug 1: This bug can be easily replicated on any wordpress sever that has a SSL certificate.

• Install WordPress
• Install BPS Security
• Force WordPress via WP-Config variables to https via:

define('FORCE_SSL_ADMIN', true);
	define('FORCE_SSL_LOGIN', true);

	define('WP_HOME','https://examplewebsite.com');
	define('WP_SITEURL','https://examplewebsite.com');
	define('DOMAIN_CURRENT_SITE', 'examplewebsite.com' );
	define('COOKIE_DOMAIN', 'examplewebsite.com' );
	define('ADMIN_COOKIE_PATH', '/wp-admin/');

• Edit the “CUSTOM CODE WP REWRITE LOOP START” section of the .htaccess and add ANY custom rule to force https and remove www, for example one below or you can use the one listed on BPS pro’s website

<IfModule mod_rewrite.c>
	# Force HTTPS & NON-WWW
	RewriteEngine On
	RewriteCond %{HTTPS} !=on  [OR]
	RewriteCond %{HTTP_HOST} !^website\.com$ [NC]
	RewriteRule ^ https://website.com%{REQUEST_URI} [R=301,L]
	</IfModule>

• Save & Activate the root .htaccess file
• Now navigate to homepage, try http://website.com/ and http://www.website.com/ and https://www.website.com/ all 3 will rewrite to https://website.com/ which is correct.
• Now try the same for http://website.com/wp-admin/ and http://www.website.com/wp-admin/ and https://www.website.com/wp-admin/ all 3 will rewrite to https://website.com/wp-admin/ which is correct.
• Activate the wp-admin folder .htaccess file
• Now navigate to homepage, try http://website.com/ and http://www.website.com/ and https://www.website.com/ all 3 will rewrite to https://website.com/ which is correct.
• Now try the same for http://website.com/wp-admin/ and http://www.website.com/wp-admin/ and https://www.website.com/wp-admin/ the two with www. are not having their www. forcefully removed

Which is a tiny, minor bug that is widely applicable to anyone who forces non-www and forces https so yes, it is a bug that can effect anyone and everyone that uses BPS. If someone has a SSL certificate for website.com but not the www. subdomain (yes these ssl certs exist, for example the new “letsencrypt” certs) then this effects them straight away.

As for Bug 2 it’s a lot harder to explain as it’s a lot more complicated and would need to be done via a video for it to make sense and done privately to you for security reasons but you clearly don’t want to fix bugs with your software.

Instead you lie about me saying that I was rude, abusive, disrespectful and attacking when you and I both know that I wasn’t.