gatorfantom

In case this helps anyone (and hopefully the dev)… I was having the same problem as the original poster, but figured out the issue and was able to fix it. (Note: Yes, I’m running the latest versions of WP and the plugin.)

My hidden login area “slug” has always contained a combination of upper and lowercase letters. When I tried accessing it today, I got the “not found” page, just like everyone else who has posted here. Well, instead of changing the plugin folder name to disable it, I opened the .htaccess file, removed the section of code that pertains to hiding the backend, saved it, and then I was able to login using the default WP slug. Once inside the plugin settings I immediately saw the problem: my original hidden slug had been converted to all lowercase letters. So I disabled the hide backend feature, then enabled it again (so it would replace the htaccess code that I had removed), and then tried logging in using the all lowercase version of my custom slug—and it worked.

So… If the people who are having this problem are also using upper & lowercase slugs, then I’m betting something happened in a recent update that is causing capitalization/case to be ignored. I use this plugin on several other sites, but the slugs are all lowercase — and I haven’t had login issues with them.

I’m wondering if this is something harmless… Comparing my current htaccess to a pre-BWPS backup copy, I see that a ‘HackRepair.com’ is writing what seems to be an extensive list of sketchy bots/websites. Is this a BWPS feature? Just wanted to make sure.

Yes; modifying the htaccess file is how the plugin is able to block the bad guys. In terms of the plugin’s overall feature set (Obscure, Protect, Detect, Recover), this falls under “Protect”.

I’ve been getting frequent emails… (Is) there a way to blacklist file change warnings?

Yes; in the plugin’s settings go to the “Intrusion Detection” section (abbreviated as “Detect” on the horizontal tabs), scroll down to “File Change Detection” and you’ll see options and instructions for customizing your notifications — including how to exclude certain files from the plugin’s detection checking process.

Understood – thanks Syed.

(PS: Go Gators)

@SuperFiles: Would you mind sharing if and how you were able to resolve this? (Your site looks accessible, though none of the images are loading for me.)

@ninthenterprises: Were you able to resolve this? (And if so, would you mind sharing how?)

I’ve used this plugin before and it worked as expected, but I did just run into a similar issue using a different plugin (and theme), so this topic is fresh in my mind right now. Here are a couple of things that may help, since the dev has responded to you yet:

1. This page describes the actual code that needs to be inserted (it’s about 14 lines of JavaScript) — and the exact location of where it needs to go in relation to your existing code. https://support.google.com/analytics/answer/1008080

2. This page goes over various approaches to deciding which file to put the GA code in. https://www.wpbeginner.com/beginners-guide/how-to-install-google-analytics-in-wordpress/

3. If you run your site through a code validator (like this one: https://validator.w3.org/) you’ll see why your GA ID is actually showing up on the site instead of being hidden. (There are about 20 errors, most of which deal with stray / improper tags in the header.)

4. Lastly, if you can’t get the plugin to work, these two are good alternatives:
https://www.ads-software.com/plugins/google-analytics-for-wordpress/
https://www.ads-software.com/plugins/google-analyticator/

Hope that helps.

the links now work but storing backups to the site is a bad idea

Agreed – but that’s why the plugin gives you the option to download the backup files to your hard drive. What else would you prefer to do with them? If you want to store them somewhere like Dropbox or AmazonS3, there are plenty of plugins that will do that. This plugin is very clear about what it does and does not do, so I’m not sure why you’d penalize it with a 1-star rating.

you can’t get to them if the site is down

If the site is “broken” or “down” and you can’t login to WordPress, you can always get into your site’s directory and files by using an FTP client/app (Cyberduck, Coda, Transmit, FileZilla, etc) – OR by going through your hosting provider’s web control panel / file manager.

also I see no way to do a restore… what good does the backup do, if you can’t restore the site.

If you go where I suggested in my first post, you’ll see an entire section titled “How do I restore my site from a backup?” It also has a link to an external how-to source (https://hmn.md/backupwordpress-how-to-restore-from-backup-files/). And there is also a complete explanation of what you’re looking for in the “FAQ” tab of this very site (https://www.ads-software.com/extend/plugins/backupwordpress/faq/).

What else can the community and/or developer do to help? I’m sure it can be frustrating trying to deal with a “broken site” – but it doesn’t sound like this plugin had anything to do with that.

1. Log into your dashboard as an admin

2. In the left nav menu, go to “Tools” > “Backups”

3. Click “Help” in the upper right corner of the screen, and the answers to all your questions (i.e. where your backup files are located; how to restore your site from a backup file; etc) will be listed right there.

So despite the facts that: A) you’re still investigating the hack; B) even if they did come in through a particular plugin’s folder, that wouldn’t automatically mean that the plugin has a security hole; and C) you’ve benefitted from using this plugin/software for four years, free of charge… You thought the right thing to do was to publicly accuse the developer, condemn the plugin, and post a 1-star rating.

Seems a tad bit unfair. Just sayin.

Take a chill pill Anusha.

Just a tip for future reference: If you’re looking for help — jumping into a support thread, ranting about how bad a plugin is, and insulting the developer (all in your very first post) — is not the greatest way to go about getting it. Especially when it’s a free plugin.

@skettiegirl:

Derek addressed this earlier. Don’t worry about FTP – all you have to do is go to the “Plugins” page of WordPress admin area; deactivate the newest OT plugin and then delete it; install the older version of the OT plugin and then activate it.

And in case you missed it, here’s the link to download the older plugin version:
https://downloads.www.ads-software.com/plugin/option-tree.1.1.8.1.zip

Thanks for the update Derek.

Just to confirm, is there a certain protocol for downgrading — or is it safe to just delete OT v2.0.5 (in admin > Plugins page) and then reinstall OT v1.1.8.1?

Upgraded to 2.0.5 and getting the same problem (all the settings under Appearance > Theme Options are being ignored.)

Derek – just an FYI in case it helps troubleshoot — I’m also seeing a yellow notice at the top of the admin screens that reads:

“Wait! You need to install and activate the OptionTree plugin! (See Help Files)”

Can you give a little more information about the PHPMyAdmin workaround? (From what I can gather, this is the only way to fix it if we’ve already upgraded to 2.0.5.?)

Thanks for you quick troubleshooting on this.

Thanks to both Derek and Curt (Cudazi) for responding so quickly and for talking through possible workarounds. It’s nice to see developers/authors collaborating like this. Says a lot about the integrity of their work.

Speaking of which… I don’t throw praise around very often, but I thought everyone reading this thread should know that Derek and Curt are two of the best in the business. OptionTree is just one of Derek’s amazing plugins, and he also does phenomenal custom themes and sites. His portfolio speaks for itself. (You’ll probably recognize some of his work). And if you’re looking for something pre-made, (IMO) Curt has the most beautiful, well-balanced themes on Themeforest, hands down. The next time you’re shopping for a simple, elegant, user-friendly theme – I highly recommend checking out his stuff.

(And no, those aren’t affiliate links. Just a couple endorsements/testimonials.)

Hey Derek – thanks for the quick response and detailed explanation. That makes sense. I went ahead and did what temash suggested, and everything’s fine.

I didn’t realize it until just now, but the OP is using the same theme as me (which explains why there aren’t too many people reporting the issue.) I think the theme author (Curt) uses OptionTree in a few of his themes, so I’ll shoot him an email and let him know what’s going on, give him a link to this thread, etc.

Thanks again.

-Tom