Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've got a weird situation whereby I sometimes can't log in as clicking on a link (or going directly) to /wp-login.php shows me a blank page with the words 'Not Permitted'.

If I go to the /wp-login.php page directly from that 'Not Permitted' page, then I can log in using my details. If I try and log out again though, I reach that 'Not Permitted' page again and can't log out.

That's a bit long-winded, so I've created a video so you can see what I mean:

http://www.youtube.com/watch?v=BI3NTiGNgoE

Has anyone come across this before? This is the first time I've seen this type of error, I've seen the 'are you sure you want to log out' error message before, but not this one...

Thanks

Osu

share|improve this question
2  
This is not a WordPress message. Disable all plugins and switch to Twenty Twelve. Does it still happen? –  toscho Apr 23 '13 at 16:54
    
Hi @toscho - thanks for this. I can't do that I'm afraid, this is a live site so I can't just switch things over, at least not until a quiet period. If it's not a Wordpress issue then I'll need to take it up with the host I guess. Have you come across this before? –  Osu Apr 23 '13 at 17:00
    
If you can't debug, that makes it hard. I have never seen that message, for what is worth. You could try clearing the domain cookies. That might help, but I wouldn't count on it. –  s_ha_dum Apr 23 '13 at 17:12
    
@s_ha_dum Ok, I'll switch the theme and disabled the plugins later this evening so there's minimal disruption. I was hoping I could try something in wp-config.php or my functions.php, but I'll try toscho's suggestion first. Thanks. –  Osu Apr 23 '13 at 17:16
    
@Osu ... if someone happens to recognize that message you are in luck. Otherwise it is going to have to be narrowed down by trial and error. Sorry. That is painful on a production server. Also, do you have debugging information that you could provide? –  s_ha_dum Apr 23 '13 at 17:18

1 Answer 1

up vote 0 down vote accepted

I made an answer out of this now to give a more detailed write-up to your question.

As the botnet is so large and the attack is happening with so much IPs (some providers say they have seen >90.000 different addresses) it makes no sense anymore to start blocking single IPs (using plugins like Limit Login Attempts or fail2ban at the server side) like we did in the past.

Your hosting company is quite right. Your page maybe is under attack. Like almost all other wordpress installations in the moment are also under attack. But they implemented a solution that's actually preventing you from working with your wordpress install.

The only REAL solution in the moment is to have a strong password that cannot be brute-forced (optionally don't even have a username admin). If you really have a safe password you can tell your provider to disable that limitation without any worries.


Also following a long discussion at the wp-hackers mailinglist, Sam Hotchkiss actually came up with a plugin called BruteProtect you could additionally use. This plugin logs all failed logins from any wordpress install this plugin is installed on and blocks any IP that has to many failed attempts.

share|improve this answer
    
Thanks for this @s1lv3r - I think this is the solution for the timebeing so have marked your answer as the correct one. By the way, how would I change the username 'admin'? I thought that wasn't possible? –  Osu Apr 29 '13 at 9:50

protected by toscho May 21 '13 at 10:53

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.