Thanks for the pointer. I read that thread after my post.
Was this addressed in version 4.2.2? I just updated to that version, and now I can’t login using an email address. It not only didn’t log me on (before this version, it did allow me to login, it just created the IP lock), but it still locks my IP address (as before), meaning to get logged in, I have to rename the plugin folder, login using my username (or email), and delete the locked IP record.
This seems like a step backwards.
Not quite. Even if a user provides the correct password and is actually logged in, the AIO add-in locks/blocks the IP (for subsequent logins from this IP) and shows an event.
Here’s a screenshot of the locked IP addresses after I logged in to my test server. I am the admin who is shown as the locked IP here, logged in via email, when the “Check this if you want to instantly lockout login attempts with usernames which do not exist on your system” is checked (on).
Edit to add: images not showing? Here’s the link: http://imgur.com/a/d5EqW
-
This reply was modified 9 years, 6 months ago by bphilly.
I’ve done some testing, and with no plugins except AOI Security (renamed the plugins directory, added the AIO plugin only), and running the 2016 theme, using the basic /wp-login screen, I still see the same results if I have the AIO setting “instantly lockout login attempts with usernames which do not exist on your system” whenever I log in using an email address. If I disable that setting, I do not see the IP locking.
I believe this is a bug. It appears to look for userid = 0 for email logins, and then locks the IP and enters it in the failed logins table, even though the login succeeds. To truly test this, I could start with a new WordPress install from scratch, but I simply don’t have the time to do that now. I’ll post the issue as mentioned above.
Thanks for the quick replies! It will take some time for me to test this, but at least I have a test server running.
We have 16 plugins installed, and are running Divi (child) theme.
