UPDATE: the problem seems to have solved itself now, about 24 hours later. It would still be useful to know what happened, though.
My team and I have tried to make 2FA plugins work with WordPress a few times, but it never seems to work properly, and I end up removing the plugin. Today, I tried to use the approach given here, which provides code for implementing an IP whitelist by pasting the following code in:
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
# whitelist Syed's IP address
allow from xx.xx.xx.xxx
# whitelist David's IP address
allow from xx.xx.xx.xxx
</LIMIT>
I was logged in with WordPress at the time, and I edited the .htaccess file via FTP. Suddenly, I cannot access our website (www.csca.ca) at all from my own IP. I can access it over LTE or with a VPN, but not from my home IP. So I just reverted the .htaccess file to what it was before, but I'm still locked out. How can I undo this?
.htaccess file before (and what it is again now)
#Begin Really Simple Security
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>
#End Really Simple Security
# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
.htaccess file after (My IP is replaced with 123... for privacy here, but I actually left my colleague's IP as xx.xx.xx.xxx, thinking I'd replace it later.)
#Begin Really Simple Security
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>
#End Really Simple Security
# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
# Begin IP whitelist
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
# whitelist Marks's IP address
allow from 12.34.56.789
# whitelist David's IP address
allow from xx.xx.xx.xxx
</LIMIT>
# End IP whitelist
When I try to access the page from my IP, all I see is this:
This site can’t be reached www.csca.ca took too long to respond. Try:
Checking the connection Checking the proxy and the firewall ERR_CONNECTION_TIMED_OUT
