Daniele Brunengo

I tried, but there is no error. I also tried visualizing errors on the browser while being on the backend page from the screenshot, but there’s just a warning about something unrelated.

Sorry, I thought I had replied but looks like I didn’t. There are no XHR requests. This is a screenshot:

Error reconnecting to database (loosely translated, I see it in Italian).

I tried, but I still get the error.

I actually don’t see a related error in error_log.

The website was moved to a new server and the domain extension changed from .eu to .it, is it possible this is causing problems?

Sorry for the late (yeah, I’m being euphemistic) response, but yes, it’s a problem with older CentOS and the solution you found only works with CentOS 7.

So I moved all affected websites to a new server with CentOS 8 (which I will have to migrate to something else soon, too).

Thanks for the help and the tips.

The server is completely managed by me and my colleagues. I have to understand if the problem hitting El Capitan happens on old CentOS versions too, because that may explain the error with your plugin.

I don’t know if it may be related with recent problems surfacing for Let’s Encrypt certificates, like this one:

https://eclecticlight.co/2021/09/21/el-capitan-and-older-mac-os-x-are-about-to-have-a-security-certificate-problem/

Probably not. But if you visit my website (the page I linked to in my first post) on a Mac with El Capitan for instance, it will tell you the certificate is not valid.

Yes, I see those buttons and the error above them.

The webserver is Apache on Centos 6, a very standard LAMP setup. It’s old but never gave us problems, also there are many websites hosted here with your plugin installed but this is happening only with Let’s Encrypt certificates.

Looks like latest updates fixed this, anyway.

Ok, thanks.

The plugin is Google Maps Easy:

https://www.ads-software.com/plugins/google-maps-easy/

and this is the page with the maps:

https://www.alassioportalparadise.edu.it/alberghiero-museo-enogastronomico/

The page is live though, you won’t find the not working links anymore.

Great fix, thanks.

I will ask Divi if and how XMLRPC is used by their theme. There are routines calling it, but I don’t know the details.

But the message I receive says an IP has been blocked after too many login attempts, you know the usual message your plugin sends when there are too many failed logins.
It gives me the username and IP address.

The websites are hosted on the same server. It’s not exactly an attack a day, there are days with more, days with none. Sometimes it’s a couple attempts, sometimes it lasts about half an hour. But the point is, I can’t understand how they are finding the modified login page.

EDIT: I’ve made some research, and I think you’re right and I’m wrong. They’re probably login attempts made via XMLRPC. Is it possible to distinguish them? Right now, the plugin will simply notify me of too many attempts, but won’t tell me if the bot tried via the actual login page or via XMLRPC.