1

I've got a weird situation whereby I sometimes can't log in as clicking on a link (or going directly) to /wp-login.php shows me a blank page with the words 'Not Permitted'.

If I go to the /wp-login.php page directly from that 'Not Permitted' page, then I can log in using my details. If I try and log out again though, I reach that 'Not Permitted' page again and can't log out.

That's a bit long-winded, so I've created a video so you can see what I mean:

http://www.youtube.com/watch?v=BI3NTiGNgoE

Has anyone come across this before? This is the first time I've seen this type of error, I've seen the 'are you sure you want to log out' error message before, but not this one...

Thanks

Osu

Improve this question
17
  • 2
    This is not a WordPress message. Disable all plugins and switch to Twenty Twelve. Does it still happen?
    – fuxia ♦
    Commented Apr 23, 2013 at 16:54
  • Hi @toscho - thanks for this. I can't do that I'm afraid, this is a live site so I can't just switch things over, at least not until a quiet period. If it's not a Wordpress issue then I'll need to take it up with the host I guess. Have you come across this before?
    – Osu
    Commented Apr 23, 2013 at 17:00
  • If you can't debug, that makes it hard. I have never seen that message, for what is worth. You could try clearing the domain cookies. That might help, but I wouldn't count on it.
    – s_ha_dum
    Commented Apr 23, 2013 at 17:12
  • @s_ha_dum Ok, I'll switch the theme and disabled the plugins later this evening so there's minimal disruption. I was hoping I could try something in wp-config.php or my functions.php, but I'll try toscho's suggestion first. Thanks.
    – Osu
    Commented Apr 23, 2013 at 17:16
  • @Osu ... if someone happens to recognize that message you are in luck. Otherwise it is going to have to be narrowed down by trial and error. Sorry. That is painful on a production server. Also, do you have debugging information that you could provide?
    – s_ha_dum
    Commented Apr 23, 2013 at 17:18

1 Answer 1

Reset to default
0

I made an answer out of this now to give a more detailed write-up to your question.

As the botnet is so large and the attack is happening with so much IPs (some providers say they have seen >90.000 different addresses) it makes no sense anymore to start blocking single IPs (using plugins like Limit Login Attempts or fail2ban at the server side) like we did in the past.

Your hosting company is quite right. Your page maybe is under attack. Like almost all other wordpress installations in the moment are also under attack. But they implemented a solution that's actually preventing you from working with your wordpress install.

The only REAL solution in the moment is to have a strong password that cannot be brute-forced (optionally don't even have a username admin). If you really have a safe password you can tell your provider to disable that limitation without any worries.

Also following a long discussion at the wp-hackers mailinglist, Sam Hotchkiss actually came up with a plugin called BruteProtect you could additionally use. This plugin logs all failed logins from any wordpress install this plugin is installed on and blocks any IP that has to many failed attempts.

Improve this answer
1
  • Thanks for this @s1lv3r - I think this is the solution for the timebeing so have marked your answer as the correct one. By the way, how would I change the username 'admin'? I thought that wasn't possible?
    – Osu
    Commented Apr 29, 2013 at 9:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.