how to reset plugin to free up access to site

Don’t think this is because iTSec does not clear things from the database.

https://www.ads-software.com/support/topic/want-to-remove-better-security-completely-database-too

After reinstall you just hit the same issue because the root cause is still there.

Focus on the issue and resolve that.

Read my lengthy second post about Hide Backend in this topic:

https://www.ads-software.com/support/topic/login-from-comment-404

dwinden

Do you need any further assistance with this ?

dwinden

@dwinden, I’ve been distracted with some other issues and haven’t yet read how to clear the database nor your second post.

I really appreciate all the help you give so I apologize for the delay.

Ball’s in my court and I’ll try to hit in the next day.

??

Ok, no worries … thanks for letting me know.

dwinden

I am needing assistance on this issue! I cannot log in once I did the hide backend feature. It shows a 404 error. I have access to phpMyAdmin and anything else I just don’t know where to go or what to check.

@dwinden, I’ve finally had a chance to go through your input on the 404 support page. I understand how the wp-admin is replaced by the hide-slug (BTW it can be circumvented but I don’t want to say here).

>>Does the Hide Backend custom\secret login slug work when accessed directly?
-no, it just goes to the front page when iThemes is active.

After I disable the plugin via ftp, “wp-admin” will get me in but I can’t delete the iThemes plugin because when reactivated, it again stops my access.

To circumvent this, I tried deactivating then doing a new install of the plugin but of course that doesn’t work either.

>>Themes:

I tried several themes including twentyfifteen. The result is the same. I cannot access the backend to delete the plugin from there because when active, iThemes will not honor the slug nor give access to the backend.

I can only get to the backend after ftp-disabling BetterWP then logging in via wp-admin.

Of course, I can just carry on without iThemes but I would like to use its other features. So I think I’m back where I started this thread.

How can I get rid of whatever code is doing the redirect to slug/hide backend so I can use the rest of the features again?

Ok, the first thing we need to determin is what Web Server is being used in that particular WordPress environment. Apache, nginx, litespeed or perhaps IIS.
And you are right (due to a bug) iTSec Hide Backend feature can be circumvented, and in your case the 404 can probably be circumvented as well, so point your browser to:

https://www.domain.com/wp-login%2ephp

(Where https://www.domain.com should be substituted by your domain)

Login and check the Web Server being used in the iTSec Dashboard page under PHP Information and then “Server Type”.
(This will also give you the opportunity to disable the Hide Backend feature).

Since Apache is the most used Web Server, for now I’ll assume this is what is being used. Correct me if I’m wrong.
It would be great if you could also determin the exact Apache version being used. This info is not always exposed so you might need to contact the hosting provider to get that piece of info.

So the Hide Backend feature will add the following line to the .htaccess file to redirect the new login slug to the wp-login.php inlog page:

# BEGIN Hide Backend
# Rules to hide the dashboard
RewriteRule ^(/)?st-admin/?$ /wp-login.php [QSA,L]

# END Hide Backend

(Where st-admin is your new login slug).
(https://www.domain.com/st-admin)

If the RewriteRule is present in the .htaccess file, for it to actually work there is still 1 important requirement to check in the Apache Web Server.
The RewriteRule will only work if the mod_rewrite module is loaded.
Create the following script to confirm the mod_rewrite module is loaded in the Apache Web Server:

<?php
$isEnabled = in_array('mod_rewrite', apache_get_modules());
echo 'Apache mod_rewrite module is ' . (($isEnabled) ? 'enabled.' : 'not enabled.');
?>

Copy it as mod_rewrite.php to the public html folder on the server and then run it from the browser like this:

https://www.domain.com/mod_rewrite.php

(Where https://www.domain.com should be substituted by your domain)
Don’t forget to delete the script when you are done.

I’ll leave it at this for now and await your feedback. To be continued.

dwinden

@dwinden, bloody iThemes should strike a medal for you!

I’m up and just checking in before I lock in a few hours on my start-the-day routine. I will go more in depth with your insights when I check back in. Thank you so much.

My servers are running Apache but I’m not so interested in fiddling with the hide backend as updates just open it to more work and they don’t seem that interested in there own product. Thank you so much for your dedication, though.

I just want to disable the hide part so I can use the rest of the features, so when I get back into it, that’s what I will be concentrating on.

More later.

@dwinden, bloody iThemes should strike a medal for you!

I’m up and just checking in before I lock in a few hours on my start-the-day routine. I will go more in depth with your insights when I check back in. Thank you so much.

My servers are running Apache but I’m not so interested in fiddling with the hide backend as updates just open it to more work and they don’t seem that interested in there own product. Thank you so much for your dedication, though.

I just want to disable the hide part so I can use the rest of the features, so when I get back into it, that’s what I will be concentrating on.

More later.

well, things have gotten really messy now.

I haven’t got to the Apache stuff yet.

Mucked around with the .htaccess for some time without being able to find that rewrite at any time (tried cntr F on different bits of the code].

I downloaded various versions of the file to my hard drive and uploaded via ftp. File size remained the same too. I tried them with ithemes active and with it inactive. Always the same result.

If iThemes is active, I can’t get to the dashboard.

So I disabled the plugin via ftp and got back in with wp-admin, disabled all plugins and then tried again ONLY with iThemes active [via dashboard]. Locked out.

Something NEW happening now. I can no longer get in anywhere [wp-admin or redirect slug] even though I ftp rename folder to -better-wp-security which always worked to disable iThemes for all the other issues.

I can’t get in at all unless I rename the plugin folder.

I swapped the htaccess files so that the one that was working is now the correct .htaccess but that made no difference.

Apache version 2.2.26
PHP version 5.4.38
MySQL version 5.5.40-36.1
Architecture x86_64
Operating system linux
Perl version 5.8.8
Kernel version 3.12.35.1418868451

@dwinden
“
Login and check the Web Server being used in the iTSec Dashboard page under PHP Information and then “Server Type”.
(This will also give you the opportunity to disable the Hide Backend feature).
“
Not sure if I’ve been clear here. But even when I could access the dashboard, as soon as iThemes was activated, I was automatically logged out so that option to disable via iThemes has been the always-problem.

Sounds like an endless struggle …

If the Hide Backend RewriteRule line is not present in the .htaccess file then that is not correct …

I think it would be best to deactivate the iTSec plugin and then delete it (if possible). Try and restore normal WP Dashboard operation, do some database checks using phpMyAdmin to make sure all traces of the iTSec plugin are gone and then reinstall the iTSec plugin from scratch.

We will probably also need to clean up the .htaccess (and wp-config.php) file. Send me those 2 files by email [moderated]. Do strip the wp-config.php of any sensitive info before sending the file.

Alternatively you could give me access to the env so I can have a look around and maybe come up with a magic touch. I won’t change anything. Just perform an audit and then discuss the result with you. Based on my findings we can then make a plan to try and turn things around.

dwinden

Thank you! I’m too much of a newbie to do most of what was mentioned here but for the first time in DAYS I was able to log in via https://www.domain.com/wp-login%2ephp
Thank you!!