dwinden

@jon

As a workaround add the following code snippet to the functions.php file of your active theme:

add_filter( 'itsec_backup_email_subject', 'itsec_backup_email_subject' );

function itsec_backup_email_subject ( $subject) {

	$subject = '[' . get_option( 'siteurl' ) . '] ' . $subject;

	return $subject;

}

Tested and found to be working.

dwinden

@ageibert

Even though iThemes claims multisite support, don’t use this plugin on multisite.

Multisite is poorly implemented. It does not function properly.
Multisite bugs hardly ever get fixed by iThemes …
There is a countless number of multisite specific bugs in this plugin.
Lots and lots of incorrect links …
And what is worse is that iThemes does not seem to care.

Save yourself a lot of troubles. Don’t run this plugin in multisite 😉

dwinden

@sergey9999

No, that is not the right module. And there is only one solution.

Try this. Create a temporary list_loaded_modules.php file and add these 5 lines of code:

<?php
echo '<pre>';
print_r(apache_get_modules());
echo '</pre>';
?>

Put the list_loaded_modules.php file on your server in the public html folder. Then access the script like this:

http://www.yourdomain.com/list_loaded_modules.php

The result should look similar to this:

Array
(
[0] => core
[1] => http_core
[2] => mod_so
[3] => sapi_apache2
[4] => mod_mime
[5] => mod_rewrite
[6]
…

If mod_authz_host does not exist in the list contact your hosting provider and ask them to load the mod_authz_host module in Apache.
Hopefully they will help you and make the necessary change to the Apache configuration.

Use the list_loaded_modules.php script to doublecheck.

Once the mod_authz_host module is loaded in Apache don’t forget to delete the list_loaded_modules.php script from your server.

dwinden

@ksteele36

Read Changing file Permissions.

dwinden

@saladgoat

Ok, so upgrading has nothing to do with this.

The following URL takes me straight to the admin login form:

http://johncodyonline.com/wp-login.php

And the following URL takes me straight to the registration form:

http://johncodyonline.com/wp-login.php?action=register

Looks like I can register anyone I want … (didn’t actually try though).
Not sure what to think of this …

The Register/Login/Lost your password? links on the bottom of the login/register forms show a URL like this:

http://johncodyonline.com/home/articles/wp-login.php?action=… etc

Where is the home/articles path coming from ?
When clicked upon all these links the result is a not_found page …

Going to the standard register URL gives me a Page Not Found error.
Going to the same URL with the secret slug, I do get the registration=disabled page.

What exact URLs did you use ?

dwinden

@zegenrijk

If it’s a temporary lockout it will expire in (default) 15 minutes.

If it’s a permanent ban navigate to the Security/Settings menu option in WP Dashboard. Select Banned Users from the drop down listbox and remove the IP from the Ban Hosts box. Then click on the Save All Changes button.

If the above info answers your question please mark this topic as ‘resolved’.

dwinden

Good morning rdekruijf,

I already tried yesterday, and I just tried it again and it works fine.

It seems that there is a cookie (myauthcookie) stored in the browser when the correct captcha is submitted. As long as that cookie does not expire the secret url will give immediate access to the admin login screen.

When I manually delete the cookie from my browser, accessing the secret url takes me to the captcha screen again.

I’m testing from the Mozilla Firefox 45.0.1 browser.
Please make sure your browser is able to create/save cookies.

dwinden