dwinden

@css31

No, I’ve tried to find out in the past (you are not the first person hitting this issue). It’s a mystery where the extra wp-login slug comes from.

Is this a manual WP download/install or was WP installed as an App from your hosting provider cPanel env ? Perhaps you should talk with your hosting provider.

dwinden

@falk Wussow

Reproduces easily. Also in my case on the third 404 the following 14 warnings are displayed on the frontend page (as well as reported in the web server error_log):

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 977

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 978

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 979

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 980

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 981

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 982

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 985

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 986

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 987

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 988

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 991

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 992

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 993

Warning: Cannot modify header information – headers already sent by (output started at /www/wordpress_temp/wp-includes/class.wp-scripts.php:200) in /www/wordpress_temp/wp-includes/pluggable.php on line 994
error

This is while using the Twenty Sixteen theme. You might not see the warnings as the frontend page goes black and\or WP_DEBUG is set to false …

dwinden

@backups

The indicated lines are upgrade lines.
It seems the log_location setting did not exist in the itsec_global option as stored in the wp_options table while upgrading.

Any idea from what version you updated ? Anything recent or an old release ?
You can find a version history on this page.

dwinden

@gerroald

No problem. I do feel I need to make one correction.

iTSec 5.3.1 (without my fix) does create .htaccess files in all three (ithemes-security, backups and logs) folders.

I guess the 3 fopen/fwrite/fclose groups of commands that create the .htaccess file(s) should be removed from the activate_execute() function in the class-itsec-setup.php file…

dwinden

@falk Wussow & @WebEndev & @gerroald

The reason why this warning is happening is because the @mkdir() command positioned 2 lines earlier is also failing…
Unfortunately because of the @ we have never been notified of this.

The @mkdir() command is failing because it tries to create a …/ithemes-security/logs subfolder while the parent ithemes-security folder does not yet exist.

Change your code to look like this and the issue will be fixed:

//Make sure the ithemes-security directory and logs subdirectory are created
if ( ! is_dir( $itsec_globals['ithemes_log_dir'] ) ) {
	@mkdir( $itsec_globals['ithemes_dir'] );  // <- Add this new line
	@mkdir( $itsec_globals['ithemes_log_dir'] );
	// Make sure we have an index file to block directory listing
	file_put_contents( path_join( $itsec_globals['ithemes_log_dir'], 'index.php' ), "<?php\n// Silence is golden." );
}

dwinden

@falk Wussow & @WebEndev

Is there also not a .htaccess file in the logs (and backups) folder(s) ?

Note all (3) commands for the .htaccess file creation are already preceeded by a @.
So if a .htaccess file does not exist in these folders its creation is also failing but you are not getting any warning because the fopen\fwrite\fclose commands are all already preceeded by a @.

dwinden

@jfheath

It would be interesting to know what Apache web server version you are using.

Do you remember whether you had IP addresses listed as banned in IPv4 and\or IPv6 format ?

IPv4 = xxx.xxx.xxx.xxx(/xx)
IPv6 = xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx(/xxx)

Anything between () is optional.

If your issue is solely caused by the IP addresses listed in the Ban Hosts setting you can prevent any IP address being added automatically to this setting by disabling the Blacklist Repeat Offender setting in the Global Settings section.
This would also allow you to enable the Write to Files setting again without a chance of the issue reoccurring.

There seems to be another topic where iThemes is investigating this issue.

dwinden

@obertscloud

Please post the content of your .htaccess file while having this problem.
And also let us know what Apache web server version you are using.

dwinden