Cannot Log In To Admin

Hello @pudbat

Internal servers errors, identified by the HTTP status code “500” are very difficult to troubleshoot because they are ambiguous by nature. If you have access to the “error_log” file that PHP generates when an error occurs, please share its content.

If all your plugins are free, please send me the list of all the ones that are currently active so I can check if there are incompatibilities among them that would cause the ”Sucuri Scanner” to trigger an internal server error.

If one or more of your plugins are premium, you’ll have to run the tests in your own website. Patiently disable all of them except “Sucuri Scanner”, then enable the other plugins, one at a time, each time check if it works okay along with the “Sucuri Scanner”. Once you find the plugin with the incompatibility, let me know and I will continue the investigation.

Hi,
It seems that I am having the same issue with one of the sites currently running this plugin. Through individually deactivating each plugin I’m using, I narrowed the issue down to the Securi plugin alone.

My error log doesn’t seen to be much help, I’m seeing 500 errors on wp-logon.php, and also 500 errors on a cron job, ex: POST /wp-cron.php?doing_wp_cron=1548818566.5804519653320312500000 HTTP/1.0. The log contains several of these errors around the time of my login attempts with a different cron id for each log entry.

Any thoughts?

Best,
Shaun

Hello @shaunmesh

The file wp-logon.php is not part of a normal WordPress installation.

It is common for hackers to create files that look like WordPress files by adding the wp- prefix. I believe you are confusing this file with wp-login.php and it probably contains PHP syntax errors which some times causes the web server to return a 500 Internal Server Error.

My error log doesn’t seen to be much help […]

The log in your comment is not an error log, it’s an access log. You need to search for a file called error_log, that’s where you can find details about the failure that is causing the 500 Internal Server Error.

—

Please keep the Sucuri plugin disabled until you can provide more information about the errors so I can continue the investigation. Otherwise, I may not be able to help you much.

Hi,
The reference to a wp-logon file was a typo, I had meant to type wp-login.php.

From the last several lines of the error_log (the same errors seem to be repeated on earlier rows, I can provide more if desired)

[Tue Jan 29 12:04:15 2019] [warn] [client 75.109.110.39] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 395, referer: https://techconnectwv.org/wp-admin/plugins.php
[Tue Jan 29 12:04:26 2019] [warn] [client 70.32.81.253] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanLatestJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 2, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548781462.0393550395965576171875
[Tue Jan 29 12:04:26 2019] [warn] [client 70.32.81.253] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanCategoriesWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 161, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548781462.0393550395965576171875
[Tue Jan 29 12:04:26 2019] [warn] [client 70.32.81.253] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanHighlightedJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 308, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548781462.0393550395965576171875
[Tue Jan 29 12:04:26 2019] [warn] [client 70.32.81.253] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 395, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548781462.0393550395965576171875
[Tue Jan 29 12:04:57 2019] [warn] [client 64.203.145.2] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanLatestJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 2, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 12:04:57 2019] [warn] [client 64.203.145.2] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanCategoriesWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 161, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 12:04:57 2019] [warn] [client 64.203.145.2] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanHighlightedJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 308, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 12:04:57 2019] [warn] [client 64.203.145.2] mod_fcgid: stderr: PHP Deprecated:  Methods with the same name as their class will not be constructors in a future version of PHP; JobmanJobsWidget has a deprecated constructor in /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/job-manager/widgets.php on line 395, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 12:09:07 2019] [error] [client 70.32.81.253] client denied by server configuration: /var/www/vhosts/techconnectwv.org/httpdocs/wp-content/plugins/really-simple-ssl/ssl-test-page.php, referer: https://techconnectwv.org/wp-content/plugins/really-simple-ssl/ssl-test-page.php
[Tue Jan 29 12:14:21 2019] [error] [client 40.77.167.9] File does not exist: /var/www/vhosts/techconnectwv.org/httpdocs/teaming-to-win-to-feature-diverse-mix-of-speakers
[Tue Jan 29 12:56:24 2019] [warn] [client 70.32.81.253] mod_fcgid: read data timeout in 60 seconds, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548784522.7991709709167480468750
[Tue Jan 29 12:56:24 2019] [error] [client 70.32.81.253] Premature end of script headers: wp-cron.php, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548784522.7991709709167480468750
[Tue Jan 29 12:58:23 2019] [warn] [client 75.109.110.39] mod_fcgid: read data timeout in 60 seconds, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 12:58:23 2019] [warn] [client 75.109.110.39] (110)Connection timed out: mod_fcgid: ap_pass_brigade failed in handle_request_ipc function, referer: https://techconnectwv.org/wp-admin/
[Tue Jan 29 13:44:51 2019] [warn] [client 70.32.81.253] mod_fcgid: read data timeout in 60 seconds, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548787430.2542300224304199218750
[Tue Jan 29 13:44:51 2019] [error] [client 70.32.81.253] Premature end of script headers: wp-cron.php, referer: https://techconnectwv.org/wp-cron.php?doing_wp_cron=1548787430.2542300224304199218750

I’ve already deactivated the Jobman plugin listed in the errors thinking that that plugin was the culprit, but thus far, deactivating the Securi plugin is the only thing that fixes the issue.

Shaun

Hi,
Just giving this topic a push, in case my reply was missed. The number of sites that I’m using this plugin that are having issues is increasing, so I’d like to see if there is something I can do to repair the install, rather than look into a replacement.

Best,
Shaun

Hello @shaunmesh

Thank you for providing some logs.

These are not error logs, but ModSecurity logs, good enough.

The only thing that seems to explain the 500 internal server errors:

• mod_fcgid: read data timeout in 60 seconds
• Connection timed out: mod_fcgid: ap_pass_brigade failed

This information, along with the fact that the Sucuri plugin seems to be the only one causing the problem, leads me to believe that one or more of the actions attached to the “admin_init” WordPress hook is taking too long to finish the process.

src/globals.php [064] SucuriScanInterface::initialize
src/globals.php [068] SucuriScanInterface::handleOldPlugins
src/globals.php [069] SucuriScanInterface::createStorageFolder
src/globals.php [168] SucuriScanHook::hookCoreUpdate
src/globals.php [169] SucuriScanHook::hookOptionsManagement
src/globals.php [170] SucuriScanHook::hookPluginDelete
src/globals.php [171] SucuriScanHook::hookPluginEditor
src/globals.php [172] SucuriScanHook::hookPluginInstall
src/globals.php [173] SucuriScanHook::hookPluginUpdate
src/globals.php [174] SucuriScanHook::hookThemeDelete
src/globals.php [175] SucuriScanHook::hookThemeEditor
src/globals.php [176] SucuriScanHook::hookThemeInstall
src/globals.php [177] SucuriScanHook::hookThemeUpdate
src/globals.php [178] SucuriScanHook::hookWidgetAdd
src/globals.php [179] SucuriScanHook::hookWidgetDelete

These are the only functions that run when you load the WordPress admin page. One thing you can do to continue the investigation is to deactivate these functions by adding the following constant to wp-config.php, then reload the admin page, if the page loads without the “500 Internal Server Error” then congratulations, you have narrowed the error down to this block of code:

define("SUCURISCAN_ADMIN_INIT", false);

Let me know what happens after adding this constant.

Hi,
Unfortunately, I added the constant to the config file for two different sites, but still received the 500 error on login.

I also increased all of the php limits I have access to update:

• memory_limit: 128M (I could push this just a little farther through a declaration in the config file, if you think this is necessary)
• max_execution_time: 120
• max_input_time: 120
• post_max_size: 16M

I have also updated the config file to post PHP errors inside of the WordPress directory, in the hopes of getting an error file that lists only PHP errors, and only those errors recorded by WordPress. No log file has been recorded as of yet, so I’m unsure if creation of the log file is being prevented by the server, or some other setting.

Both sites are currently running PHP v5.6.4.

Let me know if you need any additional information.

• This reply was modified 6 years, 1 month ago by shaunmesh.

Hello @shaunmesh

Please increase both “memory_limit” and “max_execution_time” to 1024M and -1 respectively. This will give WordPress enough resources and time to allocate whatever is triggering the server error. You can revert the settings back to their normal values once you find the bottleneck.

Settings “max_input_time” and “post_max_size” are not necessary because you are not sending anything to the server, you are just trying to load the admin dashboard, right? You can leave these two untouched, as increasing them will not make any difference in your investigation.

At this point, I would start using Xdebug Profiler, do you have it installed?