dwinden

@f1outsourcing

Oh, one last thing.

The article was written based on the 4.4.13 release available at the time.

So there is no mentioning of the Override Proxy Detection setting in the article as it was only to be included in a later release (4.5.2).

According to the 4.5.2 Changelog:

• New Feature: Override proxy IP detection

dwinden

@f1outsourcing

Amazing what you can find on the internet if you know exactly what you are searching for 😉

Read this almost 2 years old article …

Considering the fact that the iTSec plugin does provide a setting to change the (less secure) default behavior any chance for a free pizza lunch revenge bet ? … hihi 😉

dwinden

@f1outsourcing

I simply wanted to respond to your post and provide some info you might have missed but I think is certainly relevant.

Your post also made me think … (yuk ;-))

I read everywhere on the internet that using $_SERVER[‘REMOTE_ADDR’] is the most secure way of obtaining the client IP address in php.
Still not 100% safe so validation, sanitation and escaping is important.

But when the web server is behind a proxy $_SERVER[‘REMOTE_ADDR’] returns the proxy IP. This would greatly impact the Brute Force Protection feature of the plugin.

So to provide a proxy solution the iTSec plugin by default reports the IP from the (less secure) web server HTTP_% request headers (if any exist)
and otherwise falls back to using the more secure $_SERVER[‘REMOTE_ADDR’].

And the Override Proxy Detection setting provides a way to change that default behavior.

Having contemplated all this I realized it would probably be safer to simply use the more secure $_SERVER[‘REMOTE_ADDR’] by default and offer a (by default disabled) Enable Proxy Detection setting for proxy setups.

Now, I may be getting this all wrong. If so please explain. Always looking to learn new things 😉

dwinden

@vasily

Nobody knows everything 😉

You may be interested in reading this topic.

dwinden

@0xff

Correction:

… modify /core/modules/hide-backend/class-itsec-hide-backend.php file and lines 161/162:

strpos( $_SERVER['REQUEST_URI'], 'admin-ajax.php' ) === false
&& $this->auth_cookie_expired === false

to:

strpos( $_SERVER['REQUEST_URI'], 'admin-ajax.php' ) === false
&& strpos( $_SERVER['REQUEST_URI'], 'admin-post.php' ) === false
&& $this->auth_cookie_expired === false

dwinden

@quintinm

Check your web server error_log to find out which type of brute force attack is used (login page or XMLRPC).

Then take the appropriate action to prevent that type of brute force attack.

Or simply prevent any type of brute force attack if you don’t allow subscribers to your site.
(Enable Hide Backend module and if possible disable XMLRPC in WordPress Tweaks module).

dwinden

@raulferreira

Looks like this is not an iTSec plugin issue.

Deactivate one by one the other plugins and hopefully this will allow you to find the cause of the warning.

dwinden