Shield failed in preventing wp-login attack

I cannot replicate that bug. How do you know they accessed your true login url?

Paul, same thing here. https://mysite.com/wp//wp-login.php and the hidden login page is revealed. Verified on several sites.

very odd. It must be specific to certain web hosting configurations then. I’ll see what can be done

Actually are you saying that the login page fully loads?

Absolutely…
https://mysite.com/wp//wp-login.php
will load :
https://mysite.com/gluglu03 (the specific URL I picked to mask wp-login.php)

Could you test the fix for me?

Can you replace your plugin file:
wp-simple-firewall/processors/loginprotect_wplogin.php

with the content from here: (use the Raw link)
https://github.com/FernleafSystems/Shield/blob/develop/src/processors/loginprotect_wplogin.php

I am facing this problem on all of my domains. If i put the above mention code then it reveals the original hidden login page.
Yes the completely hidden login page appears.

Ashish, could you try the fix mentioned above, please?

Paul, the file did not fix it
BTW the path is:
wp-simple-firewall/src/processors
I added the /src/

who are you hosting with?
Do you have a testing, non-production-use site that I can mess with?

I’ve just been able to replicate this. I thought with the /wp/ that your site was installed within a subfolder. Now I get it. I’ll have another patch to test shortly if you don’t mind testing.

Okay, can you try again with replace that source file? I believe I’ve fixed it ??

Great! Support! Issue is fixed. Thanks a lot. You are genius!

And it’s a home run, issue is fixed! Thanks Paul!

great to hear! I’ll do the patch release tomorrow