sankari

Thank you Lars, now it works!

@tokkonopapa: We can call it joyful team work 🙂 And the gratitude is mutual. Good luck for fixing the bug!

Hello @tokkonopapa,

It’s so nice of you to help with this case, thank you so much!

On the list of plugins it says version 3.0.4.5.

Here is what I did:

1. Deactivated Wordfence plugin (which I used as a temporary substitution for WP Limit Login Attempts) and installed+activated WP Limit Login Attempts
2. Logged out of WordPress => the captcha doesn’t appear
3. Activated brower console and reloaded the login page => all files including captcha.php are listed with status 200.
4. Right click on the empty captcha image the check the image address: https://wp.domain.tld/wp-content/plugins/wp-limit-login-attempts//captcha.php. Please notice the two slashes.
5. Renamed the wp-limit-login-attempts directory
6. Logged into WordPress
7. Checked IPGB settings, see below

System information:
– Server: Apache
– PHP: 5.6.31
– WordPress: 4.8.2
– Multisite: no
– File system: direct
– Zlib: yes
– ZipArchive: yes
– BC Math: yes
– mb_strcut: yes
– DNS lookup: available [0.5 msec]
– Glow 1.0.5
– Akismet Anti-Spam 4.0
– Anti-spam 4.4
– Broken Link Checker 1.11.5
– Companion Auto Update 2.9.6
– Easy HTTPS (SSL) Redirection 1.7
– Edit Author Slug 1.5.2
– Enable Media Replace 3.1.1
– Footer Text 2.0.2
– IP Geo Block 3.0.4.5
– Meta Generator and Version Info Remover 3.3
– Page Builder by SiteOrigin 2.5.13
– Posts in Page 1.3.0
– smart User Slug Hider 1.4
– Theme Manager 2.0.1
– TinyMCE Advanced 4.6.3
– Tracking Code 1.1
– WP Custom Login Page Logo 1.4.2
– WP Display Header 4
– WP Mailto Links – Manage Email Links 2.1.6
– WP Meta SEO 3.5.2
– WP Rollback 1.5
– 2017-09-28 10:30:50 limited GET:/wp-login.php?redirect_to=https%3A%2F%2Fwp.domain.tld%2Fwp-admin%2F&reauth=1
– 2017-09-27 12:43:04 limited GET:/wp-login.php?redirect_to=https%3A%2F%2Fwp.domain.tldh%2Fwp-admin%2Fpost.php%3Fpost%3D32%26action%3Dedit&reauth=1
– 2017-09-27 12:43:00 limited GET:/wp-login.php?loggedout=true

Logs: admin area:
(empty)

Validation rule settings:
– Your IP address / Country: ***.***.**.*** / CH (Cache)
– Matching rule: Whitelist
– Whitelist of country code: CH,LI
– Bad signatures in query: ../,/wp-config.php,/passwd
– Prevent malicious file uploading: Disable
– Response code (RFC 2616): 403 Forbidden
– Response message: Sorry, your request cannot be accepted.
– Max number of failed login attempts per IP address: Disable
– Validation timing: “init” action hook

Back-end target settings:
– Comment post: Block by country
– XML-RPC: Block by country
– Login form: Block by country
– Admin area: Block by country
– Admin ajax/post: Block by country
– Plugins area: Force to load WP core, Block by country; Exceptions: WP Mailto Links – Manage Email Links
– Themes area: Force to load WP core, Block by country

I checked a WP website on another server where both IPGB and WP Limit Login Attempts are active and the captcha doesn’t appear there either.

Hello @tokkonopapa,

Okay, I cleared the cache and installed WP Crontrol. This is what it shows as cron event:

ip_geo_block_cache | None | | 2017-09-30 00:39:18 (11 minutes 8 seconds) | Non-repeating

IP address in cache now shows this:
IP address | Country code / Access | Elapsed [sec] / Calls
***.***.**.*** | CH / admin | 0 / 29

Before I cleared the cache it showed a total of two IP addresses but I don’t remember if one of them exceeded 3600.

Hopefully this helps.

Enjoy the weekend!

@tokkonopapa

By the way: The Zero-day exploit option is not activated for this customer.

Thank you for your guidance, @tokkonopapa.

It helped indeed. And here is the complete installation information for investigation:

– Server: Apache
– PHP: 5.6.31
– WordPress: 4.8.1
– Multisite: no
– Zlib: yes
– ZipArchive: yes
– BC Math: yes
– mb_strcut: yes
– DNS lookup: available [0.5 msec]
– **CUSTOM TEMPLATE** 1.0.0
– Akismet Anti-Spam 3.3.4
– Black Studio TinyMCE Widget 2.4.2
– Broken Link Checker 1.11.5
– Column Shortcodes 1.0
– Companion Auto Update 2.9.6
– Easy HTTPS (SSL) Redirection 1.7
– Footer Text 2.0.2
– IP Geo Block 3.0.4.1
– Login Logo 0.7
– Meta Generator and Version Info Remover 3.3
– Meta Tag Manager 2.1
– Simple Download Monitor 3.4.6
– Simple IP Ban 1.3.0
– smart User Slug Hider 1.4
– TinyMCE Advanced 4.6.3
– Tracking Code 1.1
– Velvet Blues Update URLs 3.2.7
– WP Author Slug 1.3.0
– WP Display Header 4
– WP Limit Login Attempts 2.6.2
– WP Mailto Links – Manage Email Links 2.1.6
– WP Meta SEO 3.5.2
– WP Rollback 1.5
– 2017-09-15 18:01:54 limited GET:/wp-admin/options-general.php
– 2017-09-15 10:55:53 limited GET:/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s=
– 2017-09-07 20:04:04 limited GET:/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s=
– 2017-09-07 20:02:38 limited GET:/wp-admin/
– 2017-09-07 20:02:28 limited GET:/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s=
– 2017-09-07 19:59:04 limited GET:/wp-admin/
– 2017-09-07 19:57:03 failed GET:/wp-login.php?captcha=7e5a3
– 2017-09-07 19:56:54 failed GET:/wp-login.php?redirect_to=https%3A%2F%2Fwww.*************.tld%2Fwp-admin%2F&reauth=1

Thank you @tokkonopapa for completing the list so quickly.