1

(oursite.com)/wp-login.php?itsec-hb-token=(our token)

  • all admin logins redirect to the home page (in a logged-in state).
  • all admin users are affected.
  • non-admin users login works well.
  • no code changes have been done. I am the only one allowed to make them. admin
  • admin login worked yesterday. today it's not.
  • all admin users have the administrator in their capabilities
  • temporarily removing the plugins folder has no effect.

we are on AWS/EC-2 running NGINX. It's been running for years. Everything works well, EXCEPT for admin logins, suddenly, without notice and without any change.

what is going on?

2
  • 1
    It could be that you've been hacked. Do you have a backup (database and files) you can restore?
    – WebElaine
    Jan 16, 2020 at 22:20
  • No, not hacked. I figured out what happened. I'll post it in an answer.
    – JasonGenX
    Jan 17, 2020 at 14:42

1 Answer 1

2

So, we figured out what it was.

In the options table (wp_options for some, we chose to do away with the wp prefix), there's a user_roles (or wp_user_roles value). One of the plugins we used (Yoast SEO in this case) had an update that zapped the value of that option, removing the Administrator role from that list. As a result, no admin could log into the admin panel. Once we restored that particular row to its former self -- things started working again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.