Viktor Nagornyy

@jnikkir
deleting foldet via FPT does NOT delete database settings, which is the cause of this issue. I’ve spent hours figuring this out. You simply need to delete database entries to allow plugin to add fresh data into database. See my thread for instructions. I’ve tested it and works on my end, on about 6 different sites.

https://www.ads-software.com/support/topic/how-to-reset-ithemes-security-plugin-to-fix-issues

No, they have no access to your WordPress for security and privacy issues. I don’t know, but maybe their Pro support can perform what I described.

If you need access to your wordpress, you can simply disable the plugin by renaming/deleting “better-wp-security” folder inside “wp-content” folder. This will disable plugin and allow you to access admin. BUT, reactivating plugin will break it again. I’ve tested it.

Hi,

I just posted this thread to reset this plugin. This will help your case, but it is advanced and requires editing database. Just thought I’ll let you know so you know there is an option.

https://www.ads-software.com/support/topic/how-to-reset-ithemes-security-plugin-to-fix-issues?replies=1

Guys, not sure what issue you had with the plugin. But it may be solved with a reset to make sure old settings are gone. Please see my instructions in this thread.

https://www.ads-software.com/support/topic/how-to-reset-ithemes-security-plugin-to-fix-issues

Guys,

If you want to keep using this plugin, you need to reset it. Please see my thread here with instructions on how I fixed this exact issue with a reset.

https://www.ads-software.com/support/topic/how-to-reset-ithemes-security-plugin-to-fix-issues

Thanks Paul. Just for anyone that will be looking for this, I started a thread under that plugin.

https://www.ads-software.com/support/topic/fatal-error-call-to-a-member-function-stat-on-a-non-object?replies=1

Guessing Miro converter doesn’t do that.

I’ll try AVS4YOU converter, see if that does the trick.

Thanks!

It’s funny because my issue is that I can’t disable it. It’s enabled by default and adds list to htaccess file no matter checked/unchecked.

We have all sizes selected, and then specific color with image. I tried specifying specific size, but that also does not work.

Hmm thats interesting. That’s what we have. I’ll check it out, thanks for the info.

This site has Jetpack enabled, and using social sharing buttons that come with it. I tried testing with a regular linkedin sharing button, which was doing the same thing.

Luckily, I was able to guess which part is causing LinkedIn sharing to not work:

# 5G:[USER AGENTS]
<IfModule mod_setenvif.c>
# SetEnvIfNoCase User-Agent ^$ keep_out
SetEnvIfNoCase User-Agent (binlar|casper|cmsworldmap|comodo|diavol|dotbot|feedfinder|flicky|ia_archiver|jakarta|kmccrew|nutch|planetwork|purebot|pycurl|skygrid|sucker|turnit|vikspider|zmeu) keep_out
<limit GET POST PUT>
Order Allow,Deny
Allow from all
Deny from env=keep_out
</limit>
</IfModule>

Not sure which bot blocks LinkedIn, but commenting out this entire portion makes LinkedIn sharing work again.

Seems that this might be a bug.

I think I understand now, I misunderstood how whitelist was working. I assumed it was bypassing brute force feature if IP was on the list. But it restricts access to those IPs alone instead. Thanks for clarifying it for me.

That’s what I was thinking when I set it up originally. But for some reason what happens is this:

1. If I give someone our secret url to login domain.com/?secret=1 they do not see login page, but instead receive 404 error.
2. If I add their IP address to whitelist, now visiting domain.com/?secret=1 works and they see login page.

We verified this on several different client computers, and I was also able to use browserstack.com to verify this on my end.

What could be causing this?

I think I noticed that whitelisting an IP address by passes cookie and allows access to wp-login.php using custom URL from brute force prevention feature. Is this correct? Can you confirm?