2

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status and error as content.

After going through a few posts on HTCPC Protocol and blogs on the same problem. I figured that it has something to do with plugin Better WP Security, which I recently installed on my Wordpress site also I found following code in inc/secure.php file under plugin code, responsible to return that response.

$bwpsmemlimit = (int) ini_get( 'memory_limit' ) 

//if they're locked out or banned die
if ( ( $bwpsoptions['id_enabled'] == 1 || $bwpsoptions['ll_enabled'] == 1 ) && 
     $this->checklock( $current_user->user_login ) ) {

wp_clear_auth_cookie();
@header( 'HTTP/1.0 418 I\'m a teapot' );
@header( 'Cache-Control: no-cache, must-revalidate' ); 
@header( 'Expires: Thu, 22 Jun 1978 00:28:00 GMT' );
die( __( 'error', $this->hook ) );

}

But as I am new to Wordpress and PHP. So I am Not able to figure out, what exactly is going wrong there. I also checked solution of problem given here, which says "It is mainly because of ftp transfer to server from local network" but I doubt its the case here as I can see that the problem persists even though we access website from different Network IPs, which were Not used in website deployment process.

One Temporary solution that I found for the problem was, to delete lockout entries from Wordpress database table <wp-prefix>_bwps_lockouts (e.g. wp_bwps_lockouts) for your IP-Adress. Using this table, Better WP Security plugin locks the user IP for some duration (typically 15 mins).

It will be very helpful to get an idea on Why Better WP Security plugin does this. So that we can take necessary steps to prevent this in future.

Improve this question
0

1 Answer 1

Reset to default
1

That is the response it gives when it you have the "Intrusion Detection" or the "Login Limits" features enabled, and the plugin has intentionally blocked you. It can block you by either username or by IP address.

The plugin can be configured to email somebody when a lockout occurs with the reason for that lockout. I suggest that you use this feature to determine the issue.

However, if you want it to stop, then you will need to reconfigure the plugin to, basically, not do that.

Improve this answer
2
  • Hey Otto, Thanks for your response. I think what you said is correct, as while digging into plugin code I found a line just above function which does lockout saying "@param int $type Type of event to log 1 for bad login, 2 for 404". Which I think essentially represent different type of action type that result in lockout. First type "1" is for Login limits (as you mentioned) and "2" is for 404, which occures when user tries to access a page where some of the resources (image, js, css etc) inside the page return 404. Which is true in my case.
    – lalit
    Jun 16, 2013 at 13:22
  • Also, I was wondering, If its the correct implementation by plugin where because of 404 response, which is a server side issue, end users face IP lockout?
    – lalit
    Jun 16, 2013 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.