Bugs in iThemes Security v4.0.0 to v4.0.12

  • We have been testing since the plugin changed from “Better WP Security v3.6.6” to “iThemes Security”
    As we were not satisfied with bugs found in “iThemes Security v4.0.0”, we switched to the other alternatives. We understood that a complete rewrite of any plugin might generate several bugs and it takes time to get a stable version. Since from v4.0.0 to the latest version 4.0.12 no such stable version found.

    Three major bugs found in v4.0.12
    (1) In particular, v4.0.12 having a new bug related to the user id=1 for default user name “Admin”. If we install WP other than the default user name “Admin” then iThemes Security v4.0.12 assuming that there is no action needed for changing user id 1, but it still displaying the message in the plugins dashboard. On clicking the message related to Admin user id, tabbing switched to “Settings” instead of “Advanced”.

    (2) Renaming wp-content not working and not resolved from v4.0.0 to v4.0.12. Tested in wp normal installation and wp install in its own directory too. We found that upto Better WP Security V3.6.6, when we rename the wp-content folder or directory then four lines of snippet added to the wp-config.php. Whereas, from iTheme Security v4.0.0 to v4.0.12 it fails to write those four lines of code on top of wp-config.php.

    Temporary solution for this is to add the following four lines code on top of wp-config.php after renaming the wp-content folder.

    define( 'DISALLOW_FILE_EDIT', true );
define( 'BWPS_FILECHECK', true );
define( 'WP_CONTENT_DIR', '/home/your-cpanel-username/public_html/wp-root-directory-name/customslug-content' );
define( 'WP_CONTENT_URL', 'https://your-domain-name/customslug-content' );

    If wordpress installed in it own directory then the following change required. Assuming that we installed wp in its own (separate folder) folder “secure”.

    define( 'DISALLOW_FILE_EDIT', true );
define( 'BWPS_FILECHECK', true );
define( 'WP_CONTENT_DIR', '/home/your-cpanel-username/public_html/wp-root-directory-name/secure/customslug-content' );
define( 'WP_CONTENT_URL', 'https://your-domain-name/secure/customslug-content' );

    Note: The above four lines actually the plugin itself writes on wp-config.php. If it fails, for temporary solution we can add the above lines to wp-config.php. Hoping that plugin author will resolve this bug in the upcoming versions.

    (3) we found that if we install wp in its own directory, then hide backend not working. For wp normal installation, hide backend working as usual.
    Temporary Solution: Copy all rules from .htaccess file in the root directory add all of them to the .htaccess file in the wp custom directory. It resolves the issue.

    https://www.ads-software.com/plugins/better-wp-security/

Viewing 6 replies - 1 through 6 (of 6 total)

  • Addition: The menu item to change the “id = 1” can not be seen, thus you can not change the ID by “iThemes Security”.

    Thread Starter *B.V.RammannaRaau*

    (@reviewkeys)

    Dear Brummbaer,

    The menu item to change the “id = 1” can not be seen, thus you can not change the ID

    We just reported these bugs to the author. What ever you explained herewith was reported in my description. Actually, Admin user ID setup available under “Advanced” options, not in Settings Tab. When you click on the message related to default admin user id, it redirects to Settings tab instead of Advanced tab. And that too it was missed in versions 4.0.10 and 4.0.12. That is what we mentioned. And we have been testing in development environment to avoid unnecessary technical issues because of the plugin complete re-write. Unless until we get a stable version it is not advisable to upgrade or instal iThemes Security in live sites.
    Just for helping others we advised and described the major issues we found at our end. Not for getting the same information from other contributor. Any how thanks for participating and contributing in the support forum. Once again we re-iterating that we are not seeking any help from other contributor except from plugin author in this regard. Since, these issues are related to the code snippets used in the plugin we have to wait for stable version. We can do nothing from our end. Just we can guide other WP users as a contribution.

    After upgrade from BWS to iThemes Security, for resolving the issues concern to this plugin, I found the following two members posts are relevant and possible workaround for recent issues:
    First Source: https://www.ads-software.com/support/topic/how-to-reset-ithemes-security-plugin-to-fix-issues?replies=33
    Second Source: https://www.ads-software.com/support/topic/locked-out-after-update-solved?replies=2

    I just installed IThemes Security to one of my websits. The “wp-content” was changed and I was given a substitute for the wp-admin for assessing the website, however I have tried to access the Dashborad with the new extension and it is not being recognized and when I login with the wp-admin everything has been disabled. Please help.

    https://online-traffic-secrets.org/rmc7ca9t2_ or wp-admin

    Thread Starter *B.V.RammannaRaau*

    (@reviewkeys)

    @marsha McPhee !
    After careful observation, we identified the root cause.
    Half of your understanding about the error you are getting is correct, but we are not completely agree with you. Sorry, to say that.
    Your understanding about the following not correct:
    1.Half of the data you entered in the wp-config.php correct. But the rest was wrong. We will mention that in later para.
    2.In your assumption, accessing backend with default “wp-admin” was disabled everything you set by iThemes Security plugin is incorrect.

    Since your are able to login are access the backend with default login urls, your DB Name, DB User, DB Password, and Table Prefix on wp-config.php are correct. No change required for these parameters.

    Now carefully follow these steps.
    The following are assumptions.
    1. Assume: your absolute path starts with “home”
    2. Assume: your cpanel user name “mcphee”
    3. Assume: your wordpress files installed in “wpfiles” folder
    4. Assume: your renamed content folder as “custom-content”

    Then you must add the following 4 lines on top of wp-config.php just after <?php

    define( 'DISALLOW_FILE_EDIT', true );
define( 'BWPS_FILECHECK', true );
define( 'WP_CONTENT_DIR', '/home/mcphee/public_html/wpfiles/custom-content' );
define( 'WP_CONTENT_URL', 'https://online-traffic-secrets.org/custom-content' );

    We can be sure that now you are able to login your site’s backend with custom login URL.
    Have a grate day.

    Thanks for your info B.V. Ramanarao but as a novice/newbie your answer is a little too technical for me. If you do not mind can you take me through the steps 1. through 4?

    1. Assume: your absolute path starts with “home”
    2. Assume: your cpanel user name “mcphee”
    3. Assume: your wordpress files installed in “wpfiles” folder
    4. Assume: your renamed content folder as “custom-content”

    Then you must add the following 4 lines on top of wp-config.php just after <?php

    define( ‘DISALLOW_FILE_EDIT’, true );
    define( ‘BWPS_FILECHECK’, true );
    define( ‘WP_CONTENT_DIR’, ‘/home/mcphee/public_html/wpfiles/custom-content’ );
    define( ‘WP_CONTENT_URL’, ‘https://online-traffic-secrets.org/custom-content&#8217; );

    We can be sure that now you are able to login your site’s backend with custom login URL.
    Have a grate day.

    I tried to insert the content as suggested but I received the following error message:

    Parse error: syntax error, unexpected ‘if’ (T_IF) in /home4/mmcphee/public_html/www.online-traffic-secrets.org/wp-content/plugins/better-wp-security/better-wp-security.php on line 20

    Reply

    Thread Starter *B.V.RammannaRaau*

    (@reviewkeys)

    In my understanding, you entered the following

    define( ‘DISALLOW_FILE_EDIT’, true );
    define( ‘BWPS_FILECHECK’, true );
    define( ‘WP_CONTENT_DIR’, ‘/home/mcphee/public_html/wpfiles/custom-content’ );
    define( ‘WP_CONTENT_URL’, ‘https://online-traffic-secrets.org/custom-content&#8217; );

    Again we confirmed that you entered wrong paths. After looking at your error we came to know that the following are required specific details.
    1. Your absolute path starts with “home4”
    2. Your cpanel user name “mmcphee”
    3. Your WP root directory (where wordpress files installed) is “www.online-traffic-secrets.org” folder
    4. Your didn’t renamed content folder, so you just having default “wp-content” folder

    We recommend to add the following four lines instead

    define( 'DISALLOW_FILE_EDIT', true );
define( 'BWPS_FILECHECK', true );
define( 'WP_CONTENT_DIR', '/home4/mmcphee/public_html/www.online-traffic-secrets.org/wp-content' );
define( 'WP_CONTENT_URL', 'https://www.online-traffic-secrets.org/wp-content' );

    Take home message:

    1.Since you just followed cPanel’s installation guidelines, your wordpress files installed in a directory name which is exactly same as your domain name. If possible try to install WP files in a directory that should not have a name like this.

    2.In our understanding, your are very new to the wordpress installation etc. In that case, better learn some technical issues before renaming wp-content directory.

    3.We can confir that your wp-content directory not yet renamed. So, you need not have to add all these stuff on wp-config.php. The above four lines of code is required if present wp-content directory renamed to something custom one. If in case you rename wp-content directory then replace the same in the above four lines of code.

    4. And last but not least, this thread started to discuss on another issues. If you still have any specific issues for your site open a new thread to address the same. That way, other members will access threads if they too have similar issues. But discussing on irrelevant threads on your issues will not get fruitful result. Hope you can understand.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Bugs in iThemes Security v4.0.0 to v4.0.12’ is closed to new replies.