Broken .htaccess file

Hi,

I’m having an issue on several sites we manage (although not all) where the site will go down when an IP is blacklisted.

Looking at the htaccess file, it appears to be getting mangled at some point.

The most common issue, is a missing “#” and extra “</”:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</</IfModule>

# END WordPress
 BEGIN Brute Force Login Protection
<Files "*">
order deny,allow
deny from 199.89.53.34
deny from 91.230.61.242
</Files>

We’ve also seen ones like this particularly brutal example:

RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# BEGIN Brute Force Login Protection
<Files "*">
order deny,allow
deny from 124.248.244.151
deny from 5.250.4.224

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
4.212.154
deny from 178.167.254.101
deny from 84.109.194.21
deny from 94.254.4.244
deny from 73.188.214.241
deny from 2.26.61.53
deny from 142.217.36.232
deny from 218.39.142.97
deny from 210.186.122.74
deny from 202.130.124.130
deny from 201.174.219.248
deny from 115.143.25.12
deny from 202.61.104.241
deny from 103.225.136.50
deny from 103.225.98.10
deny from 79.126.172.146
deny from 115.134.147.167
deny from 203.83.17.244
deny from 109.93.169.186
deny from 177.134.19.186
deny from 203.118.131.55
deny from 220.245.255.104
deny from 202.133.4.134
deny from 176.223.44.37
deny from 151.236.247.201
deny from 84.125.201.39
deny from 222.124.189.90
deny from 112.198.79.38
deny from 36.72.55.120
deny from 112.198.79.225
deny from 2.50.132.107
deny from 118.211.47.216
deny from 95.92.0.93
deny from 73.181.8.80
deny from 116.121.42.135
deny from 201.167.154.160
deny from 41.96.85.17
deny from 77.127.251.185
deny from 175.142.135.197
deny from 179.209.190.132
deny from 179.53.0.90
deny from 109.186.46.66
deny from 41.63.3.50
deny from 175.139.32.121
deny from 222.124.215.51
deny from 178.61.6.156
deny from 175.156.116.198
deny from 121.54.42.147
deny from 49.145.92.141
deny from 184.0.225.31
deny from 31.214.62.159
deny from 78.100.231.53
deny from 188.180.21.124
deny from 46.28.136.194
deny from 101.99.4.216
deny from 197.148.41.128
deny from 50.136.39.115
deny from 118.71.5.145
deny from 189.214.3.161
deny from 79.179.22.248
deny from 116.88.106.132
deny from 94.4.28.168
deny from 121.54.22.122
deny from 120.140.38.26
deny from 109.160.240.245
deny from 103.242.63.239
deny from 197.148.1.37
deny from 121.179.151.183
</Files>
# END Brute Force Login Protection

Do you have any idea why this would happen? We haven’t done anything special with the htaccess file.

https://www.ads-software.com/plugins/brute-force-login-protection/