Daniel Convissor

All password tried are VERY long and seem totally random.

The “passwords” sent in the emails and stored in the database are _hashes_ of the password, not the passwords themselves. This is for security reasons.

they eventually got a hold of the CORRECT username is quite obscure.

There are several ways. Many themes have links in the post to view content by that user. Or folks can probe various ID numbers this way: example.com/?author=1.

Also, using .htaccess in my wp-admin folder, I am blocking access to any IP address but three. HOW IS IT POSSIBLE that they can even attempt a login?

wp-login.php is in the root directory of the wp install, not the wp-admin dir.

Finally, why is it that LSS is not blocking like it should by creating long delays.?

This is covered in this plugin’s FAQ.

Oh, yeah, Skippy: When you get a chance, I would be most appreciative if you can give the plugin a good rating and a “works” vote. Financial contributions are always welcome too. 🙂 Thanks, –Dan

Skippy:

Thanks for the report and your testing. Glad I could help. The new release, 0.34.0, is out with the fix.

The reason for the bug is there are multiple code paths into my login_errors() filter method and wp-login.php uses two conventions for naming the WP_Error object: $errors and $wp_error. I had only accounted for the paths that set $errors. Now the method handles both.

–Dan

Skippywp: I made some changes to my plugin. Can you please copy this file into place and see if it fixes the problem you’re seeing?

https://github.com/convissor/login-security-solution/raw/92753deb39ea07c89a1a80897a58c3cf2b1411c3/login-security-solution.php

The Theme My Login plugin is doing something wrong, causing the $errors variable to not be available. Perhaps they’re missing a global $errors; call at the top of a function or something similar.

I just committed a change that will skip the exec() calls if safe_mode is on. It will be in the next release, 0.34.0, whenever that comes out.

Dean: For future reference, pre-setting $result was unnecessary in my tests (PHP 5.2 on a Linux box).

Hi Coatastic:

You have safe_mode and display_errors on in your php.ini.

First, basic security protocols dictate that display_errors should be off.

Second, safe_mode is deprecated and has been removed in PHP 5.4, so should not be used.

–Dan

Hi Orboan:

Plugins exist that move the wp-login.php URI. LSS’ behavior and feature set is fairly stable. I’d rather not complicate things, so will leave this feature to the other plugins.

Thanks for the suggestion,

–Dan